IP: Cross-site scripting still a threat Risks Digest 21.22

[Dave Farber <dave () farber net>]

> Date: Tue, 23 Jan 2001 14:51:14 -0500
> From: Michael Sims <jellicle () inch com>
> Subject: Cross-site scripting still a threat
>
> News.com (CNET) unveiled today a fresh new look to their site.  The two
> major innovations appear to be:
>
> a) huge, garish advertisements
> b) cross-site scripting vulnerabilities
>
> The new site accepts URL variables - user input - for page titles and
> headlines in the pages. This allows users with a moderate degree of savvy to
> "write your own CNET headlines", or write your own javascript to be executed
> from CNET's pages.
>
> You can publicize URLS like this:
>
> http://news.cnet.com/news/topic/0-1003-249-0.html?title=CNET%20Editors%20Agree:%20Slashdot%20is%20a%20better%20news%20site%20than%20News.com&topic=slashdot
>
> or this:



For archives see: http://www.interesting-people.org/