It works for me. JS enabled in your browser? On 7/11/07, Matjaz Debelak <[EMAIL PROTECTED]> wrote: > Well, it does not appear to work for me in any browser (tested Firefox > 2.0.0.3 and Konqueror). > > LP Killer_X > > Susam Pal wrote: > > There is an XSS vulnerability in HomestayFinder's 'Dictionary.aspx' > > script which is responsible for mirroring the content of Wikipedia. I > > found this interesting because here a script injected in one website > > exploits an XSS vulnerability in another website. > > > > I am including only a short example to demonstrate the issue. The > > complete document is available at:- > > http://susam.in/security/advisory-2007-07-11.txt > > > > http://en.wikipedia.org/wiki/User:Susam_pal/Sandbox consists of the > > following as the source wiki markup: > > > > <script>alert('XSS Demo')</script> > > > > http://www.homestayfinder.com/Dictionary.aspx?q=User:Susam_pal/Sandbox > > consists of the same code as HTML without the special characters encoded > > as HTML entities. Hence, the script is executed on the browser of the > > visitor. > > > > Contact Information:- > > Susam Pal > > [EMAIL PROTECTED] > > http://susam.in/ > > > > > > _______________________________________________ > > Full-Disclosure - We believe in it. > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
