Monday, September 20, 2021

Vulnerability Type: XSS (Cross Site Scripting) / CWE-79

 Recently, searching the net I found a vulnerability on the site sin0nime.com.
It is a Cross Site Scripting (XSS) vulnerability

Visiting the original site is no danger, the site is safe and does not contain any malicious code. The problem occurs when a user sends a link, which he has previously modified, to another user. What can happen to you? A window may open with a message, you may be redirected to another site, etc.

 


 Obviously I was curious to see what the vulnerability was, and I did the research on openbugbounty.org. He was the same guy who reported another vulnerability a few months ago.



Continuing the research, I also found out the code that was used to discover the vulnerability


Here is the code used:


/dex/index.php?m=0">ScanT3r<svg/onload=confirm(/ScanT3r/)>web"&cheie=Stringent

 Another example of malicious script:

cheie="></title></script><svg/onload=alert(1)>&m="></title></script><svg/onload=alert(1)>

 In fact, here is a screenshot with some tentative:

The solution is simple, the input data must be verified and validated and modified if necessary. Another solution is to use a class designed specifically for this, e.g. HTML Purifier.

Example,
 

m = 0 "> ScanT3r <svg / onload = confirm (/ ScanT3r /)> web" 

will become
 

m = 0

 


 

 

 

Saturday, September 18, 2021

85% Off Macy's Coupon Codes | 2021 Promo Codes | Dictionar sinonime

85% Off Macy's Coupon Codes | 2021 Promo Codes | Dictionar sinonime: Save 85% Off from today's popular Macy's coupon codes and sales. Never miss a chance to seize 25 tested Macy's promotions for extra savings and free shipping.


 

enigmistică.-Dicti0nar.ro electronic

Thursday, September 16, 2021

banditism - Dictionar de sinonime

Tuesday, September 14, 2021

Gonflare - Dictionar de sinonime

fluxiun-Dicti0nar.ro electronic

fluxiun-Dicti0nar.ro electronic: antonime, conjugări, declinări, definiție, definiții, dex, dexonline, dicționar, dicți0nar, dicti0nar, electronic, sinonime, traducere

40% Off Positive Grid Discount Code | Free Shipping Coupon | Dictionar sinonime

40% Off Positive Grid Discount Code | Free Shipping Coupon | Dictionar sinonime: Enjoy 40% Off discounts by using Positive Grid discount codes and sales for this September. Grab big savings from 23 veirified Positive Grid coupons today.

Monday, September 13, 2021

consom-Dicti0nar.ro electronic

consom-Dicti0nar.ro electronic: antonime, conjugări, declinări, definiție, definiții, dex, dexonline, dicționar, dicți0nar, dicti0nar, electronic, sinonime, traducere

gren-Dicti0nar.ro electronic

gren-Dicti0nar.ro electronic: antonime, conjugări, declinări, definiție, definiții, dex, dexonline, dicționar, dicți0nar, dicti0nar, electronic, sinonime, traducere

70% Off 4ocean Discount Code | Free Shipping Coupon | Dictionar sinonime

70% Off 4ocean Discount Code | Free Shipping Coupon | Dictionar sinonime: Enjoy 70% Off discounts by using 4ocean discount codes and sales for this September. Grab big savings from 10 veirified 4ocean coupons today.

Saturday, September 11, 2021

Trust The Science? CDC Counts People Dying Within 14 Days Of Jab As “Unvaccinated” – NewsWars

Trust The Science? CDC Counts People Dying Within 14 Days Of Jab As “Unvaccinated” – NewsWars: Breaking News and Information with a strong bias for telling the truth. Censored news and analysis that you won't find anywhere else.

Friday, September 10, 2021

a-Dicti0nar.ro electronic

a-Dicti0nar.ro electronic: antonime, conjugări, declinări, definiție, definiții, dex, dexonline, dicționar, dicți0nar, dicti0nar, electronic, sinonime, traducere

Thursday, September 9, 2021

reangaja-Dicti0nar.ro electronic

reangaja-Dicti0nar.ro electronic: antonime, conjugări, declinări, definiție, definiții, dex, dexonline, dicționar, dicți0nar, dicti0nar, electronic, sinonime, traducere

Saks-Fifth-Avenue Coupon

Monday, September 6, 2021

finalism-Dicti0nar.ro electronic

finalism-Dicti0nar.ro electronic: antonime, conjugări, declinări, definiție, definiții, dex, dexonline, dicționar, dicți0nar, dicti0nar, electronic, sinonime, traducere

focus-Dicti0nar.ro electronic

focus-Dicti0nar.ro electronic: antonime, conjugări, declinări, definiție, definiții, dex, dexonline, dicționar, dicți0nar, dicti0nar, electronic, sinonime, traducere

Cheapoair Discount

Wednesday, September 1, 2021

adami-Dicti0nar.ro electronic

adami-Dicti0nar.ro electronic: antonime, conjugări, declinări, definiție, definiții, dex, dexonline, dicționar, dicți0nar, dicti0nar, electronic, sinonime, traducere