Well, it does not appear to work for me in any browser (tested Firefox 2.0.0.3 and Konqueror).
LP Killer_X Susam Pal wrote: > There is an XSS vulnerability in HomestayFinder's 'Dictionary.aspx' > script which is responsible for mirroring the content of Wikipedia. I > found this interesting because here a script injected in one website > exploits an XSS vulnerability in another website. > > I am including only a short example to demonstrate the issue. The > complete document is available at:- > http://susam.in/security/advisory-2007-07-11.txt > > http://en.wikipedia.org/wiki/User:Susam_pal/Sandbox consists of the > following as the source wiki markup: > > <script>alert('XSS Demo')</script> > > http://www.homestayfinder.com/Dictionary.aspx?q=User:Susam_pal/Sandbox > consists of the same code as HTML without the special characters encoded > as HTML entities. Hence, the script is executed on the browser of the > visitor. > > Contact Information:- > Susam Pal > [EMAIL PROTECTED] > http://susam.in/ > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
