Friday, October 06, 2006

Orkut XSS - silently fixed!

On the 14th August , I got a scrap from my friend wishing me happy independence day (15 th).
I noticed one interesting thing, I could see image of Indian flag along with the scrap.

I quickly realized that something was wrong. Same scraps were floating around all over orkut that day. After modifying scrap text a little, I could verify that XSS did infact exist.

When I opened my scrap book that night, I couldn't see images any more. Had the scrap not spread on such a large scale, this XSS would have remained unnoticed I believe.

What concerned me was that this XSS was of persistent type!

Scrap Text that was used to verify this ->
Let's greet the independence of India. CHEERS!

No comments: