Posted by Kacper Szczesniak on May 24
Vendor: Gadu-Gadu (http://gadu-gadu.pl)
Vulnerable Version: All
Vulnerability Type: XSS, Remote Code Execution
Risk level: Very High
Credit: Kacper Szczesniak <kacper3.14 () gmail com>
Vulnerability Details:
Gadu-Gadu improperly handles file transfer requests. It's possible to
place 255 chars of HTML code (no slash) inside the filename. This can
lead to injecting JavaScript into UI using crafted file-send-request
packet. It's…
