bugtraq - Auction Works XXS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1058343721.3f150b2985948@webmail.bosen.net>
Date: Wed, 16 Jul 2003 15:22:01 +0700
From: Bosen <mobile@...en.net>
To: bugtraq@...urityfocus.com
Subject: Auction Works XXS Vulnerability

1ndonesian Security Team (1st)
http://bosen.net/releases/
=============================================================================
Security Advisory

Advisory Name: Auction Works XXS Vulnerability
 Release Date: 07/15/2003
  Application: Current/Running
     Platform: Win32
     Severity: Medium
     BUG Type: XXS
       Author: Bosen <mobile@...en.net>
  Discover by: Bosen <mobile@...en.net>
Vendor Status: See below.
   Vendor URL: www.auctionworks.com
    Reference: http://bosen.net/releases/

Overview:
From the web,
Just click the vendor URL or
http://www.auctionworks.com/products.asp
Author comments,
Becoz this site host many stores, im sure information of any kind,
very important. 

Details:
sfError.asp which is supposed to handle error messages, seems unfiltered
agains Cross-Site Scripting. Which is allow any attacked to inject XSS
script. 

Exploits/POC:
https://[url]/store/sfError.asp?sfid=20212&reason=<script>alert('1st')</script>

Vendor Response:
Contacted. 

Recommendation:
Filter the script.

1ndonesian Security Team (1st) Advisory:
http://bosen.net/releases/

About 1ndonesian Security Team:
1ndonesian Security Team, research and develop intelligent, advanced application
security assessment. Based in Indonesia, 1ndonesian Security Team offers best of
breed security consulting services, specialising in application, host and network
security assessments.

1st provides security information and patches for use by the entire 1st community.

This information is provided freely to all interested parties and may be 
redistributed provided that it is not altered in any way, 1st is appropriately 
credited and the document retains.