Ebay XSS Vulerability

andry Fri Nov 19, 2010 12:48 am

Ebay sites still vulnerable to cross-site scripting,html injection and redirect

all proof of concept still works fine,so be carefull!

POC:

donations.ebay.com/charity/charity.jsp?NP_ID=40219&name=XSS

worldofgood.ebay.com/Handmade-Jewelry-Earrings-Necklaces-Rings/47/list?XSS

worldofgood.ebay.com/list?HTML Injection

sea.ebay.com/searchAnnoucement.php?time=XSS

applications.ebay.com/selling?EAppsByCategory&sType=2&cId=4&cName=XSS

See also RafalLos article : eBay's Sub-Domains Vulnerable to XSS ...again