[29815] in bugtraq
CrossSite Scripting @ Snitz Forums 2000
daemon@ATHENA.MIT.EDU (badwebmasters@online.de)
Thu Apr 17 17:51:09 2003
Date: 17 Apr 2003 18:33:38 -0000
Message-ID: <20030417183338.30695.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: <badwebmasters@online.de>
To: bugtraq@securityfocus.com
Description:
The BadWord-(Script-)Filter can be tricked by adding the Tab-Char (0x09)
into the script command. This may lead to CrossSite-Scripting.
Exploit:
[img]jav asc ript:alert%28document.cookie%29[/img]
Vendor:
Has been contacted on 15. April.
Patch:
Available at http://int23.online.de/badwebmasters/txt/adv011.txt
greetZ bWM
-----------------------------------------------------
badWebMasters - online security vs. web underground
http://int23.online.de/badwebmasters
