RE: XSS in lighttpd

To: <bugtraq@xxxxxxxxxxxxxxxxx>
Subject: RE: XSS in lighttpd
From: "Bart Seresia" <bart@xxxxxx>
Date: Tue, 13 Feb 2007 00:59:53 +0100
In-reply-to: <20070209213401.12005.qmail@xxxxxxxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
Thread-index: AcdPAASn6IczGW7NRuSuR3nlI8m+awAAXWfQ

I checked this on gentoo running lighttpd 1.4.11... Nothing abnormal seen.
Just the normal page, or a 404 error.

Regards,

Bart

-----Oorspronkelijk bericht-----
Van: bl4ck@xxxxxxxxxxx [mailto:bl4ck@xxxxxxxxxxx] 
Verzonden: vrijdag 9 februari 2007 22:34
Aan: bugtraq@xxxxxxxxxxxxxxxxx
Onderwerp: XSS in lighttpd

hey guys .. check out this new xss i just found  ;P  

Vulnerable : lighttpd
web : http://www.lighttpd.net

XSS :

http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2
Fscript%3E


Discovered  By BLacK ZeRo 
bL4ck@xxxxxxxxxxx

Best regards ,,

References:
- XSS in lighttpd
  - From: bl4ck

Prev by Date: Re: DotClear Full Path Disclosure Vulnerability
Next by Date: Re: DotClear Full Path Disclosure Vulnerability
Previous by thread: XSS in lighttpd
Next by thread: SecurityVulns.com: Microsoft Visual C++ 8.0 standard library time functions invalid assertion DoS (Problem 3000).
Index(es):
- Date
- Thread