-#########                                                                                  [Saved] - [27-07-2008/20:54:23]
#     .: Multiple Cross-Site Scripting Vulnerabilities in Web Wiz Forums v9.5 in admin_group_details.asp
#     .: [Author]              CSDT
#     .: [Affected versions]   http://www.webwizguide.com/ - Web Wiz Rich Text Editor (RTE) 4.02
#     .: [Credit]  	       The disclosure of these issues has been credited to CSDT 
# ÷_____________________________________________________________________________________________ˆ 
#     .: [Script Description] 
#    (Description Provided by CVE) : Multiple cross-site scripting (XSS) vulnerabilities in 
#    Web Wiz Forums 9.5 and earlier allow remote attackers
#    to inject arbitrary web scripting. This flaw exists because the application does not validate 
#    "mode" variables upon submission to the admin_group_details.asp script. 
#    This could allow a user to create a specially craftedURL that would execute arbitrary code 
#    in a user's browser within the trust relationship between the browser and the server, 
#    leading to a loss of integrity.
# ÷_____________________________________________________________________________________________ˆ
#     .: [Classification]   
#    Attack Type:     Input Manipulation
#    Impact:          Loss of Integrity 
#    Fix: N/A         Public release vulnz: {27-07-2008 Sun}
#    Class            Input Validation Error
# ÷_____________________________________________________________________________________________ˆ
#     .: [Solution]    
#    Upgrade to version 9.6 or higher, as it has been reported to fix this vulnerability. 
#    An upgrade is required as there are no known workarounds. 
#    Actual Version: Web Wiz Forum 9.5
# ÷_____________________________________________________________________________________________ˆ
#     .: [References]
#    Original Advisory          http://depo2.nm.ru/WebWiz_Forum_v9.5_XSS.txt
#    Related Depo2 BugTracker:  http://atabeyler.org/csdt/forum_posts.asp?TID=18797
# ÷_____________________________________________________________________________________________ˆ
#     .: [Manual Testing Notes]
# ÷	
#    Web Wiz Forum v9.5 // admin_group_details.asp
#   
#   Read in the page mode
#  strMode = Request("mode")   //Line 82                                    
# ÷
# ÷_____________________________________________________________________________________________ˆ
#    .: [Script Download]     {Free lisans:  http://www.webwizguide.com/download/download.asp?DL=rte} 
#    .: [XSS] U-Code          %3C/textarea%3E'%22%3E%3Cscript%3Ealert('document.cookie')%3C/script%3E
#    .: [XSS] N-Code          </textarea>'"><script>alert(document.cookie)</script> {XSSing.Com - XSS CHEATS Auth. Depo2}
#    .: [ScreenShot]          http://depo2.co.cc/WebWiz_Forum_v9.5_XSS.jpg 
#    
#    The following proof-of-concept URIs are available:
#    .: [P0C]          http://forums.webwizguide.com/admin_group_details.asp?mode=[XSS]
#    .: [Note]: Only Admin give XSS alert Cuz XSS in AdminCP, But An attacker can exploit this issue by enticing
#                 a victim to follow a malicious URI. [login requrest]
# ÷_____________________________________________________________________________________________ˆ
#    .: [Greetings]
# ÷  
#     .:[shoutz]     L0cKed, Elrohir, xo7, Th3.Azad, Depo2, The_keSsk!N, MadNet, hayalperest, K4R4B3L4
# ÷                  ankuN, row3r, LekHe, M3M4T!, Dr.ExPERT, MuR@T, Bigboss, EjDeRx7, Arslan Yabgu, türk_üz, by.s.s,
#                 makmanaman, ÝsimsizCod3r, hackerali, **De-PreaM**, DarKWorM, Brian, |_GeCCe_|, BÝXÝi , EkBeR-I DeRYa
# ÷   
#      .: [SS]       CSDT- Atabeyler TIM - Atabeyler.Org 
-########_______________________________________________________________________________________ ####