Saturday, March 17, 2012

Disclosed another vulnerability - Triton Digital

DISCLOSED another vulnerability. Reflective Cross Site Scripting (XSS)!!!!(Not as cool as my CSRF but w/e lol)...While this company sells a service to several large companies the product that was exploited is a cloud service and nothing is installed on clients/customers servers  so this does not qualify for a CVE. I also exploited their homepage which is outsourced to a web developing company.
Reported to the company last week. More details will come once they patch(Video)!

From OWASP:

Reflected XSS Attacks

Reflected attacks are those where the injected code is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other web server. When a user is tricked into clicking on a malicious link or submitting a specially crafted form, the injected code travels to the vulnerable web server, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a "trusted" server. 


No comments:

Post a Comment