Reflected XSS in http://owaspbwa/vicnum/

[GoogleCodeExporter]

There is a reflected XSS issue in the OWASP Vicnum application
http://ip/vicnum/.  On that page, when you enter a name
of "Name<script>alert(123)</script> and press "Play", the script will run
on the next page (http://ip/vicnum/cgi-bin/vicnum1.pl).

Original issue reported on code.google.com by chuck.f....@gmail.com on 25 Oct 2009 at 12:54

• Merged into: [deleted issue] #7

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

There is a reflected XSS issue in the OWASP Vicnum application
http://owaspbwa/vicnum/  On that page, when you enter a name
of "Name<script>alert(123)</script>" and press "Play", the script will run
on the next page (http://owaspbwa/vicnum/cgi-bin/vicnum1.pl.

Example URL:
http://owaspbwa/vicnum/cgi-bin/vicnum1.pl?player=foo<script>alert(1)</script>

Original comment by chuck.f....@gmail.com on 10 Nov 2009 at 3:26

• Changed title: Reflected XSS in http://owaspbwa/vicnum/
• Changed state: VerifiedKV

[GoogleCodeExporter]

Original comment by chuck.f....@gmail.com on 20 Jan 2010 at 4:25

• Added labels: Type-KV
• Removed labels: Known-Vulnerability

[GoogleCodeExporter]

Original comment by chuck.f....@gmail.com on 20 Jan 2010 at 4:28

• Changed state: Duplicate