Can you exploit this XSS?

From: Paul Johnston (paul_at_westpoint.ltd.uk)
Date: 11/19/03

  • Next message: Robin: "Re: Can you exploit this XSS?" 
    Date: Wed, 19 Nov 2003 12:51:17 +0000
To: vuln-dev@securityfocus.com, rich@westpoint.ltd.uk

    Hi,

    While auditing a web app, I've found the site redirects not found pages
    to a login screen. This contains an element like:

    <input type="hidden" name="tageturl" value="XXX">

    Now, the XXX bit is controlled by the user, and it seems the only
    characters escaped are " and & - i.e.
    <script>alert(document.cookie)</script> gets through (hence my tool
    alerted me).

    Can this be exploited for XSS? I can't see how to immediately, but it
    seems possible.

    Paul 

    -- 
Paul Johnston
Internet Security Specialist
Westpoint Limited
Albion Wharf, 19 Albion Street,
Manchester, M1 5LN
England
Tel: +44 (0)161 237 1028
Fax: +44 (0)161 237 1031
email: paul@westpoint.ltd.uk
web: www.westpoint.ltd.uk
  • Next message: Robin: "Re: Can you exploit this XSS?"