eTransfer Lite – ‘file name’ HTML Injection
source: https://www.securityfocus.com/bid/62313/info eTransfer Lite is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible. eTransfer Lite 1.0 is vulnerable; other versions may also be affected. <bq>The following files are hosted live from the iPad's Docs folder.</bq><p><b>Images:<br><br></b> <a href="http://www.example.com/%3C[PERSISTENT INJECTED SCRIPT CODE!]%3Es2.png"><[PERSISTENT INJECTED SCRIPT CODE!]">s2.png</a> ( 51.8 Kb, 2013-08-25 02:09:25 +0000)<br /> <a href="https://www.exploit-db.com/exploits/38754/a2b642e7de.jpg">a2b642e7de.jpg</a> ( 238.0 Kb, 2013-08-25 02:08:13 +0000)<br /> </p><br><br><br><hr><br><br><br><center><form action="" method="post" enctype="multipart/form-data" name="form1" id="form1"><label>Upload file to iPad <input type="file" name="file" id="file" /></label><label> <input type="submit" name="button" id="button" value="Submit" /></label></form></center><br><br><br>Powered By <a href=http://www.example.com</a></body></html></iframe></a></p></body></html> |