XSS in WeChall
Posizione globale: 198
Punteggio totale: 110647
Posts : 1795
Grazie: 1390
Voti+: 961
Registrato: 18a 259gg
Ultima visita: 65gg 19ore
L'utente è Offline
XSS in WeChall
03 Nov 2011 - 04:11:41 (15a 1gg)
03 Nov 2011 - 04:11:41 (15a 1gg)
There was an XSS flaw found in the wechall website.
was prone to XSS.
The ajax=1 parameter turned everything vulnerable to XSS, because the content type is plaintext(no htmlspecialchars), but the header was missing.(content-type:text/plain).
I want to thank kwisatz for finding and reporting this flaw which affects pretty all of my websites :^)
Greetings
gizmore
Citazione da kwisatz
index.php?mo=GWF&me=<script>alert(1)</script>&ajax=1
was prone to XSS.
The ajax=1 parameter turned everything vulnerable to XSS, because the content type is plaintext(no htmlspecialchars), but the header was missing.(content-type:text/plain).
I want to thank kwisatz for finding and reporting this flaw which affects pretty all of my websites :^)
Greetings
gizmore
The geeks shall inherit the properties and methods of object earth.
Ultima modifica: gizmore - 03 Nov 2011 - 04:18:29
tunelko, quangntenemy, TheHiveMind, Z, balicocat, Ge0, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89, braddie0, fpombal, csuquvq utenti hanno sottoscritto il thread e ricevo le E-Mail di notifica.
1 persone stanno visualizzando il thread.
Questo thread è stato visualizzato 4928 volte.
1 persone stanno visualizzando il thread.
Questo thread è stato visualizzato 4928 volte.