I use to watch Badea’s show “In gura presei” kindly provided as a recorded streaming on antena1.ro

While listening to the stream, I could not resist checking the site design, functionality and of course it’s security.

And voila - it seems that streaming archive section of antena1.ro is XSS-reflection vulnerable.

antena1.ro XSS hack

Code for PoC XSS reflection:

Code:

DISCLAIMER: this post is intended purely for security research and educative purposes as well as intended to urge the vendor to fix the problems posing threats to its customers. Any use of this information is sole responsibility of the reader and the author is not to be held liable for any miss-use of the above informative technical details.