full-disclosure - XSS vulnerabilty on eenmiljardseconden.frankdeboosere.be

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 16 Jul 2012 07:23:39 +0000
From: Yvan Janssens <Yvan.Janssens@...co.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: XSS vulnerabilty on
	eenmiljardseconden.frankdeboosere.be

Hello,

I found an XSS vulnerability in http://eenmiljardseconden.frankdeboosere.be/ . This vulnerability was possible due to invalid input validation/bad programming. The owner  was contacted and a satiric fix was deployed.

Affected site:
http://eenmiljardseconden.frankdeboosere.be/
(media stunt of Flemish television weather forecast presentator)
Details:
After entering a message on the "Stuur een bericht naar de toekomst"-page, you are presented an unique number of your request, to track it. You were then redirected to http://eenmiljardseconden.frankdeboosere.be/messagesent/id/[number of your request]. The number could be replaced by any value to inject content into the page.

It is now solved, and if you try to execute it again, you get a link to Rick Astley's  "Never gonna give you up" on YT.
Timeline:
2012-05-29 - discovery and owner notification.
2012-05-30 - Fix
2012-05-31 - Disclosure at 42(at)discuss.hackerspaces.be mailinglist.

Regards,
Yvan Janssens

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/