Comments on: Michele get’s hit by the Bloodhound exploit http://www.3nailsministries.org/2005/03/22/michele-gets-hit-by-the-bloodhound-exploit/ Walking the walk, sometimes crawling, often falling Thu, 10 Sep 2009 22:22:08 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: pilgrim http://www.3nailsministries.org/2005/03/22/michele-gets-hit-by-the-bloodhound-exploit/comment-page-1/#comment-706 pilgrim Sat, 26 Mar 2005 02:57:10 +0000 http://3nailsministries.org/?p=84#comment-706 See...this is what I get for not completing a post! You are quite right that this is a SQL injection attack. I'm thinking that their was javascript injected into the her database that, once loaded, fired up the XSS attack bringing in the nasty stuff. I've been looking around for the actual exploit code for the bloodhound bug with no joy. I'll be moving this post to the top and finishing up the analysis soon. Thanks for the catch...you are dead on right. See…this is what I get for not completing a post! You are quite right that this is a SQL injection attack. I’m thinking that their was javascript injected into the her database that, once loaded, fired up the XSS attack bringing in the nasty stuff.

I’ve been looking around for the actual exploit code for the bloodhound bug with no joy. I’ll be moving this post to the top and finishing up the analysis soon.

Thanks for the catch…you are dead on right.

]]> By: Knox http://www.3nailsministries.org/2005/03/22/michele-gets-hit-by-the-bloodhound-exploit/comment-page-1/#comment-645 Knox Wed, 23 Mar 2005 10:57:09 +0000 http://3nailsministries.org/?p=84#comment-645 Hi, If I'm understanding correctly, you're saying that ASV's virus was due to javascript being loaded into one of the comments. Just putting a link wouldn't do it; it takes live javascript. I do not know the mechanism for capturing comments, but it seems wrong for a site to allow live javascript to run because it got posted to a comment. This seems similar to SQL injection attacks on websites, where insufficient screening of inputs allows malicious users to run their own queries against the database. If other people's javascript can run on your site, it could potential rewrite portions of the screen, cause popup ads and a whole lot more, not just attempting to infect visitors with a virus. Hi,
If I’m understanding correctly, you’re saying that ASV’s virus was due to javascript being loaded into one of the comments. Just putting a link wouldn’t do it; it takes live javascript. I do not know the mechanism for capturing comments, but it seems wrong for a site to allow live javascript to run because it got posted to a comment. This seems similar to SQL injection attacks on websites, where insufficient screening of inputs allows malicious users to run their own queries against the database. If other people’s javascript can run on your site, it could potential rewrite portions of the screen, cause popup ads and a whole lot more, not just attempting to infect visitors with a virus.

]]>