Информационная безопасность
[RU] switch to English


Дополнительная информация

  Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  Aurora WebOPAC SQL Injection - Security Advisory - SOS-12-004

  Brute Force и XSS уязвимости в Webglimpse

  Vulnerability Description: XSS-(CROSS SITE SCRIPTING VULNERABILITIES) (ZAPHOD BREEBLEBROX'S BLOCKER A.K.A. ZB BLOCK)

  phpMyVisites 2.4_XSS

From:mkey_(at)_freemail.hu <mkey_(at)_freemail.hu>
Date:19 марта 2012 г.
Subject:FrameJammer DOM based XSS

Software:FrameJammer
Author:Hal Pawluk
Software Description: FrameJammer is a little javascript code which prevents opening framed pages outside their frameset. FrameJammer used to be distributed as a Macromedia Dreamweaver extension, nowadays web developers are spreading it with copy-paste.

Problem:
FrameJammer does not validate user input (Window.Location) and therefore it contains a DOM Based XSS vulnerability.

PoC:
http://<url>?javascript:alert(123)~<frame-name>

I did not contact with the author. His website is down and I am not in the possession of his contact information.

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород