Comment spam: iframe usage
December 24th, 2006 by SecuriTeam, Filed under: Web, Commentary, Spam
lately, the bad guys have been using iframe in comments, in order to grab
the content of a spam web page and attempt to show it at the site with the
injected comment. kind of interesting, as much as it is simple:
viagra <iframe
height="1" width="1" src="http:// h ome.tiscali.cz:8080/ racktire/"></iframe>
gadi evron,
ge@beyondsecurity.com.
-
Scan your web site for vulnerabilities with a Vulnerability Scanner - Be Safe!
Subscribe
Subscribe
I don’t quite get this, the iframe gets rendered?!?
If they are vulnerable to XSS then there is no reason why not. Although one could just hijack the entire page with a
window.location=’http://SpamSite.com’
peace
Why would html be allowed in comments?