ドイツの銀行sparkasseのサイトにXSS脆弱性があり、「デモンストレーション」された。
Full Disclosure: XSS vulnerability on various german online banking sites (sparkasse)
From: Ulrich Keil
Date: Thu, 17 May 2007 06:08:34 +0200
The "Sparkassen-Finanzgruppe" with a transaction volume of over 3.300
billion euro is one of the largest banks for private customers in
germany. Many local member-banks of the group use the online banking
portal provided by sfze (http://www.sfze.de/), a subsidiary company of
Sparkassen-Finanzgruppe.
Vulnerability:
The online banking software of sfze does not check the HTTP GET
Parameter "KONTO" on the login page, and displays the content of this
variable without modification within the html form area.
Impact:
An attacker may gather login data (ID+PIN) from customers of the
Sparkassen-Finanzgruppe by tricking them to click on a special crafted
link, which points to the original login page of the online banking system.
Leave a comment