635229 - xss redirect and html injection

Status: VERIFIED WONTFIX

(support.mozillamessaging.com Graveyard :: General, defect)

Description

[marius]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13 ( .NET CLR 3.5.30729; .NET4.0E)
Build Identifier: 

support.mozillamessaging.com  XSS 


poc:  

http://support.mozillamessaging.com/tiki-listpages.php/"<marquee><img src=k onerror=alert("XSS") />
 
http://support.mozillamessaging.com/tiki-orphan_pages.php/"onmouseover=prompt(1337)>

see: 

http://img3.imageshack.us/i/mozat.jpg/

http://img69.imageshack.us/i/mozzw.jpg/


Reproducible: Always




Security Bug Bounty Program

Comment 1

[Michael Coates [:mcoates] (acct no longer active)]

Confirmed. Make sure there is a space in the url between "k" and "onerror" when testing.

Comment 3

[Michael Coates [:mcoates] (acct no longer active)]

Who should this be assigned to? The issue is still present.

Comment 4

[Andrei [:sancus]]

Can assign this to me too, but this will go away when we make kitsune live after the All-Hands in any case.

Comment 5

[Daniel Veditz [:dveditz]]

mozillamessaging.com sites are not currently covered under our web bug bounty program. We do thank you for reporting it. For the list of covered sites please see the web security blog post about the program.

Comment 6

[Andrei [:sancus]]

This goes away today as well due to moving to kitsune!

Comment 7

[Raymond Forbes[:rforbes]]

please update the respository so it is clear this code has this vulnerability.  This is in case somebody pulls it down for some other purpose.