[Full-disclosure] 0day Orkut XSS [ NEW! ]

[Fabio N Sarmento [ Gmail ]]

Greetings!
Doing hard searches and working hard seeking for xss holes we finally found!

The new hole is in the description of the pic, you can put html encode chars
like this.

& l t ; meta http-equiv="refresh" content="0;url=http://suafakeaqui" & g t ;

&lt; means < (minus) or open tag.
&gt; means > ( more ) or close tag.

So you can build great javascripts to stole cookies and whatever you want ;)

*Proof of concept:*

My Profile: http://www.orkut.com/Album.aspx?uid=4196484633792069568 ( just a
javascript with location.href='mypersonalwebsite.com' )

Thanks to Pedro Boara ( http://www.suspensa.info )

Att;
Fábio N Sarmento
Programmer
São Paulo / Brazil
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20071012/dca8f391/attachment.html