[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] Godaddy´s workspace <= 5.3 XSS
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] Godaddy´s workspace <= 5.3 XSS
- From: "Carlos" <chollmann@xxxxxxxxxxxxxxxx>
- Date: Sat, 11 Dec 2010 08:58:03 -0700
<html><body><span style="font-family:Verdana; color:#000000;
font-size:10pt;"><div>Godaddy´s Workspace 5.3
XSS</div><div>Explanation:</div><div><span style="">The javascript for
special caracter filtering provided in <a
href="http://email13.secureserver.net";>email13.secureserver.net</a> can be use
to create a XSS attack, if we edit the
content of an email and put <iframe
src="javascript:alert("XSS");"></iframe> this will be filtered
and scramble, making the XSS impossible, BUT, if we write <iframe
src="javascript:alert(&quot;XSS&quot;);"></iframe> we
will bypass the XSS filter.</span></div><div>by
Elvenking</div></span></body></html>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/