mailing list archives
[0 Day] XSS Persistent in Blogspot of Google
From: ANTRAX <antrax.bt () gmail com>
Date: Mon, 21 Jan 2013 21:01:33 -0200
Hi all, I'm ANTRAX from Argentina, and I'm owner of www.underc0de.org
Today, I going to shared with you about XSS in blogger. This is a very
simple, but isn´t fix yet..
This bug could be exploited by bloggers without administrator permissons.
Steps to reproduce the XSS:
1.- Create a new post in the blog and insert some script
[image: Imágenes integradas 1]
2.- When the administrator enter in the administration panel in "templates"
section, blogger automatically executed the script, because blogger have a
mini-preview in "Ahora en el blog", then execute the script
[image: Imágenes integradas 2]
3.- Ready! the script has been executed!
[image: Imágenes integradas 3]
Also, you can steal cookies!
[image: Imágenes integradas 4]
I reported to google about it, but they not fixed yet.
Kind regards partners!
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
Re: [0 Day] XSS Persistent in Blogspot of Google WHK Yan (Jan 22)
- [0 Day] XSS Persistent in Blogspot of Google ANTRAX (Jan 22)