Mail.ru: [cfire.mail.ru] Time Based SQL Injection

Добрый день. Уязвимо кукис с названием cfiresid. Рабочий PoC GET /account/userbar/ HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/47.0.2526.73 Safari/537.36 OPR/34.0.2036.25 Host: cfire.mail.ru Accept: text/html, application/xml;q=0.9,...

Mail.ru: XSS Vulnerability in cfire.mail.ru/screen/1/

On the cfire.mail.ru/screen/1/ page, the following HTML is generated: html By appending "alert0 to the end of the URL, an XSS vulnerability is triggered causing the javascript code: alert0 to execute. So the final URL to trigger this vulnerability is:...