Full Disclosure mailing list archives
A question of the xss vulnerability's Proof of concept
From: supercodeing35271 supercodeing35271 <supercodeing35271 () gmail com>
Date: Sun, 8 Aug 2010 23:30:01 +0800
Hi,i have a rookie's puzzle of some xss vulnerability bug report. If there is a vulnerability Poc in a report just like this: http://www.example.com/index.php?id=<img src=g onerror=alert(document.cookie)> or http://www.example.com/index.php?id=<img src=g onerror=alert("xss")> OK,this may cause a alert when run the url.But my question is that why it can say this: "Vulnerability Details: User can execute arbitrary JavaScript code within the vulnerable application." I see many report have the same words.Why a alert could be output then we just can say "User can execute arbitrary JavaScript code within the vulnerable application"? The last is that i am a rookie,seems that this is a stupid ask but it is a true puzzle on me. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- A question of the xss vulnerability's Proof of concept supercodeing35271 supercodeing35271 (Aug 08)
- Re: A question of the xss vulnerability's Proof of concept Justin Klein Keane (Aug 08)