Description
A cross-site scripting (XSS) vulnerability exists in doku.php of DokuWiki 2012-01-25 Angua. The target parameter of an edit action is written back into the page without HTML encoding.
Impact
An attacker can run arbitrary JavaScript in the browser of a user who opens a crafted edit link. In an administrator session the injected script can read the CSRF token of the wiki and then perform administrative actions, which is the route used by the related CSRF issue in CVE-2012-2128.
Solution
Encode the target parameter before output. Upgrade to DokuWiki 2012-10-13 Adora Belle or later.