[Full-disclosure] XSS vuln- swapitshop.com

Vendor: SwapitShop.com- 'Safe cash for young people that they can earn & spend on things they want.'

Discovered by: robokoder

N.B. admin were informed 20 days ago... no fix yet- appalling

 

this is a cross-site scripting (XSS) vulnerability that allows for the injection of potentially malicious _javascript_ into links that appear to go to the trusted http://swapitshop.com. The injection is in the search form, the input of which is not properly filtered. Vuln link (non-malicious demonstration): >> alert(document.cookie)">http://www.swapitshop.com/cgi-bin/swapitshop/browse.cgi?username=&ac=&action="">> <<

this can obviously be exploited, e.g. to direct the user to a fake login page so the hacker can steal their password, and thus their swapits. Alternatively it could direct the user to a site where their cookies are stolen. There are obviously other possibilities, but you get the idea...

Given the nature of this site where users put their faith in virtual currency, not fixing a vuln like this immediately, let alone after 20 days is unnaceptable. It is being released to force them to fix it, and ultimately in the interest of their users.

 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/