SecNews · Report #144084
Content spoofing due to the improper behavior of the not-found message
Validstatus
7upvotes
9 Aug 2016disclosed
Summary
The researcher detected a low level issue. Due to the approach of the researcher we decided to disclose it publicly.
The issue detected in https://www.secnews.gr , It's possible to inject text in the not-found message in order to trick the user to make him visit another website or do something an attacker might be interested in POC:https://goo.gl/Cuj53g : The link is shortened .
Even the issue is out of scope But @secnewsgr deiced to accept it due to the good approach had on that issue.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.