[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] Allegro.pl XSS [0-day]
- To: Kacper Szczesniak <kacper@xxxxxx>
- Subject: Re: [Full-disclosure] Allegro.pl XSS [0-day]
- From: Swair Mehta <swairmehta@xxxxxxxxx>
- Date: Thu, 11 Apr 2013 11:33:24 -0700
Well try the "search" on plantronics website.http://www.plantronics.com/us/
No body notified, I couldnt see the contact us link
On the first page.
On 11-Apr-2013, at 9:28 AM, Kacper Szczesniak <kacper@xxxxxx> wrote:
Hi All!
I was looking for a 19" rack mount today and found this XSS instead:
http://allegro.pl/listing/listing.php?string=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E
it turns out to be a custom data-headline attribute that is not properly
escaped
tested on Firefox 20, Chrome and others need an xss filter bypass
kacper
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/