Dragons Kingdom Script v1.0=0D =0D Homepage:=0D http://www.dkscript.com/=0D =0D Affected files:=0D =0D *Sending mail:=0D - Sending in-game mail=0D =0D =0D *Character Profiles:=0D - All input boxes of the profile=0D =0D =0D * Posting & Replying in the forum:=0D - Posting in the forum=0D - Replying in the forum=0D =0D * Form spoofing can occur in:=0D - Profile input boxes=0D - Posting in the msgboard=0D - Sening in-game mail.=0D =0D * Gambling Den:=0D - High or low game.=0D =0D * Exploring=0D - Using the compass=0D ---------------------------------------------=0D =0D XSS vuln with cookie disclosure when sending in-game mail:=0D =0D User data isn't sanatized before being generated. =0D =0D For a PoC send someone a mail that says:=0D =0D=0D =0D Screenshots:=0D http://www.youfucktard.com/xsp/dragking1.jpg=0D http://www.youfucktard.com/xsp/dragking2.jpg=0D =0D Displaying our cookie:=0D http://www.youfucktard.com/xsp/dragking3.jpg=0D --------------------------------------------=0D XSS vulns with cookie disclosure in character profiles:=0D =0D The form for editing your player profile can be spoofed to increase the maxchar limit to create our xss example.=0D =0D Vulnerable profile input boxes:=0D =0D - Gender=0D - Country/Location=0D - MSN Messenger=0D - AOL IM=0D - Yahoo IM=0D - ICQ=0D =0D Screenshots:=0D http://www.youfucktard.com/xsp/dragking4.jpg=0D http://www.youfucktard.com/xsp/dragking5.jpg=0D ------------------------------------------=0D XSS vuln when posting in the forum or replying:=0D =0D User data isn't sanatized before being generated. =0D =0D For a PoC put the code below as your forum topic or msg:=0D
