Facebook Quiz Monster Persistent XSS Vuln

on
About Facebook Quiz Monster
It helps you to create your own quiz facebook application! Quiz Monster makes it simple, fun and easy!

Vuln found :
Persistent XSS VUln

create your own quiz 1st and insert your xss scripts in the options available there...like for example

">< script > alert("w00t")< /script >


once done go and check your quiz

currently this application has 14,238,107 monthly active users ....and so the attackers can also try to steal their cookies (didnt try but you can)

One such quiz is
http://apps.facebook.com/quizcreator/quizzes/714688/play


Here is a screenshot:

0 comments:

Post a Comment