Welcome, Guest. Please login or register.
+  Linux Soft Forum
|-+  Află» Linux Soft» inca un xss in bash.linuxsoft.ro		 [Picture 161] [Picture 160] [Picture 159]
Username:
Password:
Home Help Login Register
 
Pages: [1]   Go Down
« previous next »
  Print  
Author Topic: inca un xss in bash.linuxsoft.ro  (Read 1178 times)
0 Members and 2 Guests are viewing this topic.
hydrarulz
Veteran
**

warning flame-war


WWW
« on: March 24, 2008, 12:21:48 PM »
in
http://bash.linuxsoft.ro/search/

in formular variabila ascdesc, si anume:
<select id="order" name="ascdesc">
se trimite cu valoarea:
' "><script>alert(1)</script>

rezulta aceeasi faza cu echo mysql_error() cum este explicata aici: http://websecurity.ro/blog/2007/11/22/xss-in-mysql_error/
Logged

http://www.websecurity.ro
wonder
Veteran
**


WWW
« Reply #1 on: March 24, 2008, 01:19:03 PM »
fixed
Logged
Give what you have. To someone, it may be better than you dare to think.
My blog wonder.rodp.net
hydrarulz
Veteran
**

warning flame-war


WWW
« Reply #2 on: March 24, 2008, 01:57:42 PM »
nu e fixed.
acum e un "<script>" inainte. deci daca postez
ASC' "></script><h1>aaaa</h1><script>alert(1)</script>
tot merge ...
try again
« Last Edit: March 24, 2008, 01:58:42 PM by hydrarulz » Logged

http://www.websecurity.ro
~Empathy~
Veteran
**

Decadence is Bliss...
« Reply #3 on: March 24, 2008, 04:03:42 PM »
Fixed.
Logged
blog.mgk.ro
Saltwater
Veteran
**

Whatever™


WWW
« Reply #4 on: March 24, 2008, 07:04:07 PM »
Bai Johan, cate gauri ai? :D Ranjeste fasolea
Logged


Astazi nu am semnatura.
Pages: [1]   Go Up
  Print  
« previous next »
 
Jump to:  

Theme by m3talc0re. Powered by SMF 1.1.5 | SMF © 2006-2008, Simple Machines LLC