Well, this has been there for quite a long time. Another variation (which can control the title content too, making it more believable) :
https://www.facebook.com/connect/connect_to_node_error.php?title=Really%3F&body=Hello%20World ! But yes, AFAIK, html tags cannot be injected. Although, a self-xss attack could be done. https://www.facebook.com/connect/connect_to_node_error.php?title=Official%20Facebook%20Script&body=Copy%20and%20paste%20the%20following%20script%20in%20the%20address%20bar%20:%20javascript:alert(document.cookie) ; That's the max you could do with it (I think!) Thanks, Atul Agarwal Secfence Technologies http://www.secfence.com On Mon, May 23, 2011 at 12:16 AM, ichib0d crane <[email protected]>wrote: > Turns out....not so much :P > > > https://www.facebook.com/connect/connect_to_node_error.php?body=%3Cscript%3Ealert%28String.fromCharCode%2888,%2083,%2083%29%29%3C/script%3E > > Sure maybe there is a way to bypass the filter but good luck. > > Probably be a good idea to include a better PoC next time. > > > On Sun, May 22, 2011 at 11:28 AM, Gustavo <[email protected]> > wrote: > > > https://www.facebook.com/connect/connect_to_node_error.php?body=VULNERABLE > > > > :( > > > > _______________________________________________ > > Full-Disclosure - We believe in it. > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
