[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [Full-disclosure] [Low-Hanging Fruit] Craigsphone Transcoder Open
From:       "Jeremi Gosney" <epixoip () hush ! com>
Date:       2009-05-30 10:01:36
Message-ID: 20090530100136.6BD6620043 () smtp ! hushmail ! com
[Download RAW message or body]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Craigsphone is a mobile phone app for viewing and managing
Craigslist pages. It relies on a WAP transcoding service for re-
formatting and serving pages on Craigslist. The transcoder does not
perform any validation on the 'uri' parameter, allowing it to
function as an open redirect.

POC:
http://nextmobileweb.com/craigslist/tr_page?uri=http://www.google.co
m
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 3.0

wpwEAQMCAAYFAkohBAAACgkQacHgESW3wZqZUgP/cVREs3jGqhLdJhCEsloWJAdcJ/if
8Y/mxM3Sml+KPdA/TffnY46zaFtuGQ34wrw9g3Mus0e/6NKdEBX8PYaevGNJnMx/4YOX
U8xF7lPT/NUPB7KaOcjCnRthNAGkuc1C5J9MhQt44Psetz+cNOVQEht1XOJPjIIqlGJA
HDVm/do=
=RmL6
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[prev in list] [next in list] [prev in thread] [next in thread]