3 ms·
It looks like the "XSS" bug is mostly client-side, I think that the GET contents are presented using JS: http://grab.by/exu http://grab.by/exu (that's with the
by adrinavarro 17y ago
It looks like the "XSS" bug is mostly client-side, I think that the GET contents are presented using JS: http://grab.by/exu http://grab.by/exu (that's with the given URL).
It doesn't allows any kind of <script> tag, so yeah, it's fun and a bit insecure (may be used for phishing?? dunno), but it's not the worst at all.
- willwagner 17y agoIt allows you to put javascript in a click handler: http://www.apple.com/itunes/affiliates/download/?artistName=%3Cimg%20src=%22http://cheapestblog.info/wp-content/uploads/2009/06/click-me.jpg%22%20onclick=%22alert%28%27hello%20world%27%29;%22/%3E http://www.apple.com/itunes/affiliates/download/?artistName=...
- adrinavarro 17y agoI was wrong, you're right! Now that's medium-insecure. But still not to panic at this, just XSS and client-side (everything is inserted by JS). Well, there are worst things, right? :)
- chrisbroadfoot 17y ago"just" XSS?
- NathanKP 17y agoOn Safari the click handler works but the image just shows up as an error, not a "Click Me" message.