Yes XSS on the official page of the ruling party. Following our announcement of the new facility Secleaks offered by SecNews.gr, we received a notice that is worth publishing. The sender of the vulnerability (as you will see in the first picture) is Nyo from the Greek Hacking Scene (GHS) team.
We also have the vulnerability links available to any interested manager who wants to resolve the issue.
See the images that show the vulnerability:
For those who do not know:
Provided Cross-site scripting ή ΧSS αναφερόμαστε στην εκμετάλλευση διάφορων ευπαθειών (vulnerabilities) υπολογιστικών συστημάτων με εισαγωγή code HTML or javascript σε κάποιο site. Κάποιος κακόβουλος χρήστης, θα μπορούσε να εισάγει κώδικα σε έναν ιστοχώρο, μέσω ενός κειμένου εισόδου για παράδειγμα, ο οποίος αφού δεν θα φιλτραριζόταν από τον ιστοχώρο σωστά, θα μπορούσε να προκαλέσει προβλήματα στον διαχειριστή ή επισκέπτη της by clicking hereof target.
Example:
http://www.example.com/index.html?name=
The malicious user could succeed:
Theft of passwords / accounts etc of personal data
Change website settings
Theft of cookies
Fake advertising (via, for example, a link)
Vulnerability refers to the weakness of the system that the site supports to filter and reject any harmful inputs.
SecNews.gr remains at the disposal of any interested party to solve the problem.
Definition of XSS from Wikipedia.
