Cross Site Scripting Vulnerability in Speed Bit Search Engine
The Hacker News

Debasish Mandal, A hacker from India , Found that there is a XSS through JavaScript Injection vulnerability in the Home page of Speed Bit Search Engine.The XSS filter is filtering normal html /script /iframe tags but XSS can be achieved by injecting JavaScript event "onmouseover()".Technical Description is below. Debasish have reported the vulnerability to the Speed Bit Team but haven't yet got any response from their side.

Proof Of Concept:
1) Visit this URL" onmousemove="alert(document.cookie)
2) Bring mouse cursor over the hyperlink shown in the image and you should see a POP up box showing the browser cookies.
The Hacker News

Submitted By : Debasish Mandal, India.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.