Risks
Vulnerabilities
Browse by
ICQ Portal Cross Site Scripting vulnerability
21 September 2001
Bookmark and Share
--[ ICQ Portal multiple Cross Site Scripting vulnerability ]--
Problem discovered: 19/09/2001 by Cabezon Aurélien |
aurelien.cabezon@iSecureLabs.com | http://www.iSecureLabs.com

--[ Overview ]--

The icq portal suffer from multiple Cross Site Scripting Vulnerability. http://www.icq.com

-- [ Description ]--

ICQ web portal may inadvertently include malicious HTML tags or script in a dynamically generated page based on unvalidated input from untrustworthy sources.

This can be a problem when a web server does not adequately ensure that generated pages are properly encoded to prevent unintended execution of scripts, and when input from a form is not validated to prevent malicious HTML from being presented to the user.

This search script http://search.icq.com/dirsearch.adp does not check anymore for malicious HTML or Java Script code.

Exemple 1
http://search.icq.com/dirsearch.adp?query=<h1>Hello</h1><script>alert('hello ');</script>est&wh=is&users=1

Screen Shots:
http://www.isecurelabs.com/advisory/icq1.jpg
http://www.isecurelabs.com/advisory/icq2.jpg

Exemple 2
http://web.icq.com/foo/<script>alert('hello');</script>;

Scree Shots:
http://www.isecurelabs.com/advisory/icq3.jpg
http://www.isecurelabs.com/advisory/icq4.jpg

--[ Fix ]-- ICQ Team has been alerted

--[ Informations about CSS ]--


http://httpd.apache.org/info/css-security/apache_specific.html
http://www.cert.org/advisories/CA-2000-02.html

---
Cabezon Aurélien | aurelien.cabezon@iSecureLabs.com
http://www.iSecureLabs.com | French Security Portal
http://www.isecurelabs.com/advisory/icq-css.html




Spotlight

Patching: The least understood line of defense

Posted on 29 August 2014.  |  How many end users, indeed how many IT pros, truly get patching? Sure, many of us see Windows install updates when we shut down our PC and think all is well. It’s not.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Tue, Sep 2nd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //