Rev Potential exploit.

[Dan Smith]

Basicly. i belive that rev is xxs cross scriptable.

All thats needed is to set your motto to <script>alert('XXS')</script> and on online, it sends an alert.


Does anybody have a fix for this?

The fix will be largely appreciated!

Also, you may want to know:
Whats is XXS?

You must be registered for see links

-Dan

 

[Clit]

and on online, it sends an alert.

Explain that.

 

[Dan Smith]

 

[Find]

Basically it means if they put that code in their motto, anywhere on the site that it shows their motto a script will pop up

 

[Clit]

Basically it means if they put that code in their motto, anywhere on the site that it shows their motto a script will pop up

Its for staff use only then pretty much, don't see how it is an exploit. It's basically putting %username% in your motto.

 

[Legion]

Doesn't effect my hotel?

 

[Dan Smith]

No, all users can use it

--------------------------------------------

Legion, wheres your hotel, i will try to show it you

 

[Clit]

anywhere on the site that it shows their motto

No, all users can use it

...

 

[Find]

Well the user could use it on the me page, and we have an online users page as you just saw so it would not only work for staff

 

[Dan Smith]

it shows up on online users page. its XXs cross scripting, that's an exploit

 

[Clit]

Well the user could use it on the me page, and we have an online users page as you just saw so it would not only work for staff

Me page, only the user can see.
Online users is like a graph thing, and have to hover, doubt that enables/works like that. (idfk wot i seD)
and its a staff ability, and for vip's its a special feature, and if they are one of the lucky randoms. 

it shows up on online users page. its XXs cross scripting, that's an exploit

dont even have mottos enabled on online users page -.-
tbh, even if its a popup, who cares, ITS A POPUP, no harm

 

[Tomm]

it works on the /online page for all users, as every online user is displayed here. I think Mr Find fixed the issue by disabling mottos on the /online page.

 

[Find]

As you quite clearly did not read the link posted on the original post,

"Cross-site scripting (XSS) is a type of

You must be registered for see links

You must be registered for see links

typically found in

You must be registered for see links

, such as

You must be registered for see links

through breaches of

You must be registered for see links

, that enables attackers to

You must be registered for see links

You must be registered for see links

into

You must be registered for see links

viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass

You must be registered for see links

such as the

You must be registered for see links

. Cross-site scripting carried out on websites accounted for roughly 84% of all security vulnerabilities documented by Symantec as of 2007.

You must be registered for see links

Their effect may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner."​

So as you can see it is more of a risk than "just a popup"

 

[Tomm]

tbh, even if its a popup, who cares, ITS A POPUP, no harm

So as you can see it is more of a risk than "just a popup"

This pop up could ALSO be abused, showing advertisements or inappropriate messages. This is un-professional.

 

[Clit]

it works on the /online page for all users, as every online user is displayed here. I think Mr Find fixed the issue by disabling mottos on the /online page.

regardless, no reason to remove the code, its a fucking popup, also nobody knew of this, lol, never been used anywhere. blame op for releasing ;p, REGARDLESS, ITS A FUCKING POPUP LOL

 

[Xyro]

tbh, even if its a popup, who cares, ITS A POPUP, no harm

I think what he's trying to say is if that alert script can be used, then they could manipulate the XSS code and end up putting shells into the server.

 

[Clit]

This pop up could ALSO be abused, showing advertisements or inappropriate messages. This is un-professional.

yeah deffiantly with limited motto characters. 

I think what he's trying to say is if that alert script can be used, then they could manipulate the XSS code and end up putting shells into the server.

tell me how you're gonna do that in 12 fucking characters..

 

[Xyro]

yeah deffiantly with limited motto characters. 

tell me how you're gonna do that in 12 fucking characters..

Short website link dumbass.

 

[Find]

Ok so are you saying someone having their motto as "<script>alert('PENIS')</script>" it would not look unprofessional?

 

[Dan Smith]

<script>alert('Devbest')</script>

30 char <3