Cross Site Scripting Vulnerability in Speed Bit Search Engine
Debasish Mandal, A hacker from India , Found that there is a XSS through JavaScript Injection vulnerability in the Home page of Speed Bit Search Engine.The XSS filter is filtering normal html /script /iframe tags but XSS can be achieved by injecting JavaScript event "onmouseover()".Technical Description is below. Debasish have reported the vulnerability to the Speed Bit Team but haven't yet got any response from their side.
[Check it on Firefox]
Proof Of Concept:
1) Visit this URL http://search.speedbit.com/?aff=grbr" onmousemove="alert(document.cookie)
2) Bring mouse cursor over the hyperlink shown in the image and you should see a POP up box showing the browser cookies.
Submitted By : Debasish Mandal, India.
0 comments:
Post a Comment