[36041] in bugtraq
Type xxs
daemon@ATHENA.MIT.EDU (root@spiffomatic64.com)
Sun Aug 8 02:00:08 2004
Reply-To: <root@spiffomatic64.com>
From: <root@spiffomatic64.com>
To: <bugtraq@securityfocus.com>
Date: Fri, 6 Aug 2004 18:03:52 -0400
Message-ID: <004101c47c01$45a02070$6500a8c0@Moonunit>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Vendor : typepad.com
URL : http://typepad.com
Risk : Cross site scripting
Description: TypePad is a powerful, hosted weblogging service that gives
users the richest set of features to immediately share and publish
information -- like travel logs, journals and digital scrapbooks -- on
the Web. TypePad lets people communicate, publicly or privately, with
the audience of their choosing.
Cross site scripting: The filtering script for the name form doesnt
filter " if preceeded by a ?. The cross site scripting works because the
<a href=" tag can be closed by a target url with " which then permits
the user to use such oneventhandles as onmouseover.
Solution: The easiest way would be to just replace all characters with
their &#xx; equivilant.
Credits: Credits goto my loving fiance, you push me todo things i never
thought possible.
Exploit: This is exploited by passing a url with malicious javascript to
the name variable.
Spiffomatic64
Hacking is an art-form
-Matt Oyer
Spiffomatic64.com
