bugtraq - Cross site scripting in Onecenter forum 4.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <47440.80.58.4.235.1051236077.squirrel@www.vsantivirus.com>
Date: Thu, 24 Apr 2003 23:01:17 -0300 (ART)
From: "David F. Madrid" <conde0@...efonica.net>
To: <bugtraq@...urityfocus.com>
Subject: Cross site scripting in Onecenter forum 4.0

Issue : cross site scripting in Onecenter forum

Affected Product : Onecenter forum 4.0

Description :

Onecenter offers a free discussion forum hosted in the company's servers (
forum.onecenter.com ) . Any user in the forum is identified by a cookie
that contains nick , name , mail address and password . This information
can be easily obtained as you can add in your posts the img html tag with
a custom script as follows
<img src=javascript:alert(document.cookie);>

To impersonate any user in the forum ( onecenter administrators would be a
good choice ) you just have to build a cookie like the one obtained and
visit the forum .

-- 
Regards ,

David F. Madrid
Madrid , Spain