full-disclosure - 0day XSS for MPAA.org

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <fe37588d0712042026o6a385459t4a1cea0ab86bd540@mail.gmail.com>
Date: Tue, 4 Dec 2007 20:26:02 -0800
From: "Kristian Erik Hermansen" <kristian.hermansen@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: 0day XSS for MPAA.org

As many of you have heard, the MPAA themselves are violating the GNU
GPL.  Such hypocrisy from a company which claims they adhere to
copyrights :-)  In protest, I took exactly 7 seconds to locate an XSS
in their website and am posting it for your perusal.  Maybe someone
can use it in an email to an MPAA staff member, and perhaps can modify
the payload to steal credentials for some MPAA admin interface.  And
perhaps then, after gaining MPAA credentials, this person can modify
the MPAA website.  And perhaps after that, we can all laugh at the
MPAA yet again in their quest to sue 12 year old kids for downloading
MP3 files...

There are many more XSS on their site.  Everyone knows that if you
find one bug on top (without much effort), there are many more
security issues hiding beneath the surface.  I leave it up to the
MPPA-haters out there to dig deeper and use it to "influence" the MPAA
website...

Here's one for the 'txtsearch' search field on the main page at
MPAA.org in the top right-hand corner where it says 'Find the rating
of a film'...
ERR"></tr></table></td><script>alert('xss');</script>
-- 
Kristian Erik Hermansen
"I have no special talent. I am only passionately curious."

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/