"Andy Meyers" <andy.meyers (at) hushmail (dot) com [email concealed]> wrote in message
news:20060409235034.1AAAC17042 (at) smtp2.hushmail.com. (dot) . [email concealed]
> My BlackICE stops this from XSS from happening, however changing the URL
> from a .ae domain to a .com and leaving the rest in tact, I am then
> prompted.
>
> http://www.google.com/search?hl=ar&q=<script>alert("1")</script>&meta=

The flaw is very exploitable, basically any search that includes a books
result and contains script will trigger the flaw, the .com seems to only
include the flaw in arabic, and sometime depending on the users location or
some other thing (I can't identify).

Using a different search to trigger more book results allows you to much
more easily exploit it.

http://jibbering.com/blog/?id=506 and http://jibbering.com/blog/?id=507
show a phishing exploit and a gmail contacts stealing method using the above
attack.

Google still appear to be unable to do the simple programming matter of
encoding of user input before writing it back out.

Cheers,

Jim.

[ reply ]