piątek, 27 września 2013

[EN] Alcatel OneTouch Website - XSS & SQL Injection

SO - first thing is, that both bugs are really obvious...I can't belive they exist so long in official Alcatel One Touch website.

How to reproduce bug:
1) Go to http://alcatelonetouch.com website
2)  Search for bad'syntax or f<script>alert(1);</script>
3) Get alert or PHP Error (in case you're trying to exploit XSS or SQLi).

XSS:



SQLi:



I think this case is so basic, that it don't need to be explained.

Ok - now the funny part - timeline.

05/02/2013 - discovered the bug
06/02/2013 - contact using e-mail provided in WHOIS database
13/02/2013 - no response, contacted USSupport@tcl.com
11/03/2013 - mailed to Polish Alcatel-Lucent department with request of some contact info for my case
11/03/2013 - response from Alcatel-Lucent - forward me to TCL Communication
12/03/2013 - mail sent using official TCL contact form
13/03/2013 - after googlin' - found some employee working for TCL and contact info - sent mail.
29/04/2013 - no response - tried to contact using info.america@tcl.com
12/06/2013 - still no response, tried to contact with some sales managers, found on Alcatel website
28/06/2013 - Twitted @ALCATELONETOUCH about vuln and requested for contact informations
02/07/2013 - no response - another tweet.
04/07/2013 - stil no response - another tweet
08/07/2013 - ...and another ;)
09/07/2013 - everybody please, sit down - I've got first Alcatel response. It tells that I should contact using their Official Facebook.
09/07/2013 - Contacted using facebook.
10/07/2013 - Response that confirms, that informations about fact, that I found some issue in their website was sent to their "team".
10/07/2013 - Problem was, that I didn't provided any details about vulnerability, even what kind of issue it is ;) I asked if they need any details.
11/07/2013 - I sent really detailed advisory about vulnerability I found.
16/07/2013 - got response with confirmation of sharing my details with their tech team.
24/07/2013 - tried to get some other info - no response
07/08/2013 - ping -> no response.
27/09/2013 - not fixed -> Public Disclosure

Feel free to comment. :)

-- UPDATE --
At 12/11/2013 one of TCL IT Managers responsible for AlcatelOneTouch.com website contacted with me. We cooperated to fix this issues and from now on it's ok. :)

38 komentarzy:

  1. Not much to say... http://farm5.staticflickr.com/4092/5173801529_0f3a6be8b8.jpg

    OdpowiedzUsuń
    Odpowiedzi
    1. very good article Really I got very valuable information here.

      Best Shop


      useful article for me. Thank you for letting me know. Digitalo Your blog has useful information; you are a skilled webmaster.

      Usuń
  2. I believe renting creek from this transact, N' primary acquire, Little or an absense of back to you uncovering of people in politics, Not any urban centre legal workers determined in which on the way to allow them up so that it will lead the actual way in, Resulting in nil urban center retirement when they get home for the day. It has an amazing variety of tsouris, Aggro, Utilization of newspapers, Investment in running shoes house, But also late evening various. That you may become needing to wear surgery.I hop doctor.

    tags: Ray Ban Prescription Sunglasses, Ray Ban Round Sunglasses, 2020 Jordan Release Dates, New Black Yeezys, Air Jordan 1 Sale, Ray Ban Sunglass Hut


    OdpowiedzUsuń

  3. https://www.onlinedocumentarys.com/

    https://www.onlinedocumentarys.com/buy-passports.html

    https://www.onlinedocumentarys.com/buy-id-cards.html

    https://www.onlinedocumentarys.com/buy-drivers-license.html

    https://www.onlinedocumentarys.com/buy-visa.html

    OdpowiedzUsuń
  4. MyAssignmentHelpNow, who help students globally at all academic level. We work 24*7 so that you don’t need to wait for any certain time, you can reach us any time. For our online assignment help you can directly get into touch with our expert.

    OdpowiedzUsuń
  5. You can work on yourself but we all know it takes time to acquire something and learn a skill. So, to bring some instant difference to your scores you can simply hire assignment help online and get your work done from them. Because you will get a lot to learn from assignment help experts. If you have never taken assistance from any genuine professional you are missing a lot.

    OdpowiedzUsuń
  6. Get the quick translation help services in singapore from the top rated translation company in Singapore.Our experts offerica translation services in singapore for various kinds of documents like passport,immigration,visa and others in various languages like malay,chinese,thai,korean,arabic and many more.

    OdpowiedzUsuń
  7. Are you going to apply for immigration at uscis office then you should hire Global translation service because their team deliver you perfect documentation of immigration into desired language.By getting this help you can fully understand the procedure and applied policies.

    OdpowiedzUsuń
  8. Hello, thanks for sharing such pretty informing blogs
    Call us +44-7451282508 all you need to do to help yourself is to knock the doors of online assignment help service providers, and they will take care of the rest. They can assist you with writing at any difficulty stage, Our one of the best onlHello, thanks for sharing such pretty informing blogs
    Call us +44-7451282508 all you need to do to help yourself is to knock the doors of online assignment help service providers, and they will take care of the rest. They can assist you with writing at any difficulty stage, Our one of the best online assignment help will give you best solution be it High School, College, University, Masters or Ph.D. on any topic and subjectine assignment help will give you best solution be it High School, College, University, Masters or Ph.D. on any topic and subject

    OdpowiedzUsuń
  9. Enjoyed reading your post keep sharing such amazing post will come back to read more. make my thesis

    OdpowiedzUsuń

  10. The prime reason that our custom retail packaging is making presentation packaging leaps and bounds is that there is no minimal box requirement, hence custom printed boxes no minimum. However, we also have custom boxes wholesale for businesses that need product packaging in an extensive count. Above all, we have a quick turn-around time, so your parcel doesn’t get delayed, i.e., eight to ten days at maximum.

    OdpowiedzUsuń
  11. There is certainly a great deal to find out about this topic. I really like all of the points you made. paid thesis writing services

    OdpowiedzUsuń

  12. So if you have any queries regarding term paper writing service your work or our service you research paper writing can get connected with our customer care executive through a live chat session, phone call service or mail facility and you will get instant help with your requirements These are some unique benefits that you will experience if you avail of our writing assistance.

    OdpowiedzUsuń
  13. If you are planning to translate the immigration then hire immigration document translation from our experts who are well qualified.

    OdpowiedzUsuń
  14. Nice information found over the internet. This is so useful to me. If you are searching for Coinbase Customer Support Number . Please Contact Us.

    OdpowiedzUsuń
  15. Besides, producing the best Assignment Helper Online and bespoke scholastic research papers for every academic stream, We guarantee you the best academic grades for each of your assignments. Our confidence lies in the profoundly qualified and highly experienced subject experts we have on our panel.

    OdpowiedzUsuń
  16. The theme of your article would be ideal to describe in the english essay example paper with the help of our website where skilled writers provide their services.

    OdpowiedzUsuń
  17. If you are stuck in the middle of an assignment and term end examination not
    knowing whom to ask for help; sign in to Great Assignment Helper who provide
    the best Help with my Psychology Assignment at the cheapest of prices

    OdpowiedzUsuń
  18. Nice Artical ! It deserves a big thumbs up.Micros Digital is one of the most Innovative and Creative Digital Marketing Institute, Advanced Digital Marketing Course in Laxmi Nagar
    to help you Boost Your Business and Get Ahead of Your Competition with result oriented

    OdpowiedzUsuń
  19. Such a great information for blogger i am a professional blogger thanks. exam helper malaysia

    OdpowiedzUsuń
  20. PLI dates back to 1884, offering various insurance policies. The Company limited its policy cover to postal department employees and later expanding to the telegraph department and general public. Postal Life insurance The insurance provider works with government employees, financial sectors, educational institutions, and other sectors in India. PLI has upgraded from traditional premium payments to new digitalized services. This allows premium holders to clear payments through online services.

    OdpowiedzUsuń
  21. I enjoy reading insightful and reliable content. فروشگاه اینترنتی Your blog has useful information; you are a skilled webmaster. Continue to post.

    OdpowiedzUsuń
  22. Great Blog! love to read keep sharing such well written blogs.
    Waistcoat for Men

    OdpowiedzUsuń
  23. AssignmenthelpSingapore.sg provides accounting homework help to all accounting students in Singapore.

    OdpowiedzUsuń
  24. Godrej Splendour is a futuristic residential project developing in 17.76 acers of land in Whitefield, Bangalore.

    OdpowiedzUsuń
  25. Godrej Park Retreat is a futuristic project of Godrej Properties. It offers premium houses. It is located in Sarjapur road, Bangalore.

    OdpowiedzUsuń
  26. Prestige Park Ridge is more than just a residential development; it's a sanctuary that harmoniously blends serenity and urban sophistication. Whether you are seeking a peaceful abode amidst nature's beauty or a luxurious lifestyle with modern amenities, Prestige Park Ridge caters to all your desires.

    OdpowiedzUsuń
  27. Kumar City is a well developed township project which is located in Manjri, Pune.

    OdpowiedzUsuń
  28. Provident Deansgate is an upcoming modern project by the Provident Housing. This project offers modern houses.

    OdpowiedzUsuń
  29. What a fantastic post! It's crystal clear that Online Nursing Assignment Help is spearheading the industry in delivering top-notch assignment writing services. Your steadfast dedication to delivering high-quality services firmly establishes you as a market leader. Nursing assignments can be incredibly demanding, and your reliable support is a true boon for students in this field. Your unwavering commitment to academic excellence is truly commendable. Keep up the exceptional work, and I'm confident that countless more students will benefit immensely from your expertise and guidance in their nursing studies. Kudos to your team for consistently delivering outstanding service! 👏📚💯 #NursingAssignmentHelp #QualityService

    OdpowiedzUsuń
  30. Nice post, I really liked it. It is very interesting and Informative Blog. Know 10x10 trade show booth ideas and Exhibition Stands Fabricator and More Details Visit - Xpostands

    iacp conference 2023 san diego
    Frankfurt Buchmesse 2023
    virtual exhibition definition

    OdpowiedzUsuń
  31. So Informative blog. I Read your Some blog It Awesome. Keep it Up. If you want to know about Exhibition Stands and Your have a business and want to Promote your Brand Globally the Exhibition Stands builder and trade show booth design company in barcelona helps you. Visit- Fountainhead International

    OdpowiedzUsuń
  32. Great post! It's evident that your commitment to delivering top-notch Assignment Help in Canada is truly remarkable. Students across Canada are fortunate to have access to your services, which undoubtedly make their academic journeys smoother and more successful. Your dedication to providing assistance is highly commendable, and it's clear that you prioritize quality and reliability. Your post is a testament to your commitment to supporting students in their educational pursuits. Keep up the fantastic work, and continue to be a valuable resource for those seeking guidance and aid with their assignments in Canada. Your contributions are invaluable to the academic community.

    OdpowiedzUsuń