The reader of iGuRu.gr, J0k3R-GR, reported an XSS vulnerability to us in the browser game ikariam.gr. We quote the notification e‑mail that was sent to the website administrators.
“See the image, I discovered a security hole in your website, it is XSS (evidence in the image), it can be used for malicious purposes.”
And the proof of the vulnerability
The link to the image in higher resolution
is https://postimg.org/image/
Continuing, J0k3R-GR says:
XSS vulnerabilities are exploited by injecting HTML or Javascript code into a page. This code is not filtered and can therefore cause corruption in the website code.
Thus a malicious user can cause:
1.Theft of personal data
2.Cookie theft
3.Changes that only the administrator can make
4.Advertising
5.Uploading a Shell
and many more.
To see if a page is vulnerable to XSS attacks, you then place in some textbox of the page:
<script>alert('XSSed')</script> Many times, however, this is not enough.
The attacker may need to use various techniques to bypass filtering, for example by writing this:
<sCRipt>alert('xss')</scriPt>and many more.
We thank the reader of our website J0k3R-GR for reporting the vulnerability to us and to the administrators of the browser game, who, as shown by the response date on the ticket, responded promptly.
📧
Subscribe to the SecNews Newsletter
