[Kil13r-SA-20060701-3] Massting Cross-Site Scripting Vulnerability
Title:
[Kil13r-SA-20060701-3] Massting Cross-Site Scripting Vulnerability
Author:
Kil13r - http://www.kil13r.info/
Local / Remote:
Remote
Timeline:
2006/06/30 - Discovery
2006/06/30 - Vendor notification
2006/06/30 - Vendor response
2006/06/30 - Vendor fix
2006/07/01 - Release
Affected version:
Not affected version:
Description:
Massting is AJAX chat service site, but that has vulnerability.
It can run arbitrary Javascript code by end user in message input form.
Proof of Concept code:
<img src="javascript:alert(String.fromCharCode(88,83,83,32,53580,49828,53944))">
Proof of Concept example:
None
Proof of Concept screenshot:
None
-
The Bird of Hermes is my name,
Eating my wings to make me tame.