Bugtraq mailing list archives

404 error XSS

From: Josh Zlatin-Amishav <josh () tkos co il>
Date: Wed, 14 Sep 2005 23:40:07 +0300 (IDT)

The following web servers do not properly sanitize their output when
returning a 404 resource not found error which could be used in a XSS
attack:

Orion 1.3.8Orion 1.4.5CompaqHTTPServer 2.1


PoC: http://localhost/<script>alert('XSS')</script>

--
 - Josh

Current thread:

404 error XSS Josh Zlatin-Amishav (Sep 15)