FN SECURE: Cross Site Scripting Vulnerability in Speed Bit Search Engine

Call Us For Workshops Or Seminars.. In Your University, Colleges, or Schools.
Email Us At : vicky@globallyunique.in

Cross Site Scripting Vulnerability in Speed Bit Search Engine




Debasish Mandal, A hacker from India , Found that there is a XSS through JavaScript Injection vulnerability in the Home page of Speed Bit Search Engine.The XSS filter is filtering normal html /script /iframe tags but XSS can be achieved by injecting JavaScript event "onmouseover()".Technical Description is below. Debasish have reported the vulnerability to the Speed Bit Team but haven't yet got any response from their side.

[Check it on Firefox]
Proof Of Concept:
1) Visit this URL http://search.speedbit.com/?aff=grbr" onmousemove="alert(document.cookie)
2) Bring mouse cursor over the hyperlink shown in the image and you should see a POP up box showing the browser cookies.










Submitted By : Debasish Mandal, India.

Leave a Reply

Save this Page

Download as PDF