Bugtraq mailing list archives
RE: [Opera 7] Yet Another Story of "Phantom of the Opera"
From: "GreyMagic Software" <security () greymagic com>
Date: Wed, 30 Apr 2003 18:56:22 +0200
This vulnerability is caused by script in Opera 7's console.html that is not enough to sanitize single-quote.
We've notified Opera of this concern almost three months ago (05-Feb-2003), after 7.01 was released. Here is a part of the original mail we sent: --- Opera 7 security fix --- ... we did find another concern in the new version. Using opera.postError, it is still possible to use: opera.postError("http://');alert();"); This will cause a new debug message to be added to the console. If the user clicks this URL in the console, the alert will be executed. This scenario is not very likely though, because it requires that the user clicks an "odd" looking URL. --- Opera 7 security fix --- Opera answered this email two days later, saying a fix will be included in the new version. Apparently, they didn't take this scenario one step further to filter out ' as well. Cheers.
Current thread:
- [Opera 7] Yet Another Story of "Phantom of the Opera" nesumin (Apr 28)
- <Possible follow-ups>
- RE: [Opera 7] Yet Another Story of "Phantom of the Opera" GreyMagic Software (Apr 30)