bugsnothugs at gmail
Nov 3, 2009, 4:20 PM
Post #1 of 1
(85 views)
Permalink
|
|
e-Courier Tracking Site Multiple Script UserGUID Parameter XSS
|
|
Vendor: e-Courier (http://www.ecouriersoftware.com/)
Product: CMS Tracking Site Issue: Cross-Site Scripting.
Description: Nearly all pages include the URI Parameter UserGUID,
which is not sanitized before being included in the response.
Example:
https://demo.e-courier.com/demo/home/index.asp?UserGUID="><script>alert(document.cookie)</script>
--
BugsNotHugs
Shared Vulnerability Disclosure Account
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
|
