Who could imagine?
The long uncorrected xss flaw rears it’s ugly head again!
Auctionbytes reporting that falle-internet.de has again discovered listings with the malicious coding, this time with a virus twist.
The most important and telling quote of the article:
“They used javascript and java to address a known vulnerability; user’s computers were affected by just viewing the respective listings,”
See that part about “…just viewing the respective listings…” ?
That is one of the main reasons I advocate avoiding ebaY at all costs. Another is that they BLAME the USER for their own failures! Furthermore, they refuse to correct the flaw! Make no mistake, ebaY is a dangerous, untrustworthy, and dishonest website. Of that there is proof beyond the slightest shadow of a doubt!
ebaY is HACKED! Yes! ebaY is still HACKED!!!
Here is the report, with screencapture images, in English at falle-internet
My research indicates this issue has been onging at ebaY for about 10 full years now. Perhaps not under the same name, but indeed cross-scripting has been exploited on ebaY since before it even had that name. Ebay has been aware of the issue for that long also. Since looooong before the US-CERT warning was posted. Bear in mind there are many variants of this exploit possible to use. It’s been used also for the redirects, and for cookie-stealing etc. The possibilities are only limited by the hacker’s imagination and ebay’s steadfast refusal to secure it’s festered site
I’ll be posting another video demonstrating the +/- 10 year longevity of the xss flaw on ebaY before long at the Cappnonymous channel
