2

I have discovered a possible security flaw in a login for a site that many people rely on. I won't say the site but in the URL there is something similar to

/Success?message=Success+please+wait+a+bit+for+results

/Failure?message=Failure+Please+try+again

I know all about XSS, and you can't get JavaScript to be embedded even with trickery, but it still prints what you put in the message query.

I think this could possibly be used in social engineering attacks

How dangerous is this? (it CAN be hot-linked)

2
  • Some sites opt for that, others display it within <body> tag, but as long as the message does not disclose some sensitive info nothing is wrong with that. All what you can do is to try manipulating the variable message with the common techniques. And do not ask more because questions about how to break a system are not allowed – user45139 Aug 27 '15 at 9:01
  • The message query allows you to input anything and it will display, so is it not a security flaw that it could be linked and show someone text that you want whilst making it look like its coming from the site? – Bear Aug 27 '15 at 9:04
1

You can host all the phishing emails there. For example:

We have detected suspicious behavior on your account. All furthur login requests will be denied. Please use the alternative login form at http://example.com/ to do a secure log in and unlock your account.

4
  • Yes, this is about along the lines of what i was thinking. The web master has not responded to my email and it has been a couple weeks. Many people rely on this website, what should I do? – Bear Aug 27 '15 at 9:06
  • @KevinFroman I don't usually find security holes on other site, so I'm not sure what to do exactly. Maybe that's another question. – user23013 Aug 27 '15 at 9:08
  • Alright, thanks for your feedback. Its a physical place so I'll try to find someone to talk to in person about it when I can. – Bear Aug 27 '15 at 9:11
  • I would assume that you probably can't inject clickable links though. If XSS is not possible, '"> are probably encoded. Phishing might still be possible, but that makes it a bit more difficult (eg "For security purposes this link is not clickable. Please copy-paste it: [link to phishing site]"). – tim Aug 27 '15 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.