X
Tech

Active XSS flaw discovered on eBay

According to XSSed, Shubham Upadhyay has discovered an active XSS flaw affecting Ebay.com.
Written by Dancho Danchev, Contributor
Ebay_XSS_November_2012

According to XSSed, Indian security researcher Shubham Upadhyay has discovered an active XSS flaw affecting Ebay.com.

The potential attacker would need an Ebay seller account, where he would put XSS code into the HTML. The vulnerability could be used to trick users into trusting Ebay.com's reputable Web position in an attempt to serve client-side exploits to them. And that's just for starters.

Ebay.com is a popular target for malicious attackers, looking for ways to abuse and hijack the steady inflow of traffic hitting the site on a daily basis, and security researchers who on the other hand attempt to prevent abuse of the site by discovering and reporting security vulnerabilities to Ebay's Security Team.

Mozilla Firefox's NoScript proactively detects the XSS attempt, and blocks it.

The XSS flaw remains unfixed for the time being. eBay's Security Team has been notified.

Find out more about Dancho Danchev at his LinkedIn profile.

Editorial standards