Jeremy Kirk Nov 27, 2014
The Weather Channel has fixed a common web application security problem on its website that made nearly all links vulnerable to cross-site scripting attacks.
Wang Jin, a doctoral student at the School of Physical and Mathematical Sciences at Nanyang Technological University in Singapore, found more than 75 percent of the webpages on Weather.com were vulnerable.
“Attackers just need to add script at the end of The Weather Channel’s URLs,” Wang wrote. “Then the scripts will be executed.”
Wang posted his findings on the Full Disclosure forum, writing that the issues have been fixed. He wrote that he tested tens of thousands of links on Weather.com using a custom tool and posted a video illustrating an attack.
Full Article
Login to the community
No account yet? Create an account
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.