Информационная безопасность
[RU] switch to English


Дополнительная информация

  Подмена фокуса в Mozilla Firefox (focus spoofing)

From:carl hardwick <hardwick.carl_(at)_gmail.com>
Date:30 июня 2007 г.
Subject:[Full-disclosure] New flaw found in Firefox 2.0.0.4: Firefox file input focus vulnerabilities

PoC here: http://yathong.googlepages.com/FirefoxFocusBug.html

The vulnerability allows the attacker to silently redirect focus of
selected key press events to an otherwise protected file upload form
field. This is possible because of how onKeyDown event is handled,
allowing the focus to be moved between the two. This enables the
attacker to read arbitrary files on victim's system.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород