Hi guys, as title, i found a non persistant xss on a pretty famous site in italy (based on alexarank, top 50 in Italy). I e-mailed the webmaster reporting the issue, but they didn't answer to me nor fixed the problem, what am i supposed to do? Should i reveal the vulnerability? I mean, if they don't answer i guess they don't consider it as a risky problem and actually they may be right. Just to let you know, this site is in some way linked to ebay 😖
🤝
and sorry for my english.
DO NOT DEAL WITH THIS MEMBER
Did you report this days ago, or just some hours ago?
If you reported this a couple of hours ago, than I would wait a little longer.
Feb 21, 2014 12:43 PM
(This post was last modified: Feb 21, 2014 12:44 PM by haffy.)
When did you contact them? Maybe they're busy and haven't gotten to you yet or maybe they don't see the importance of the vulnerability being fixed.
If they don't have it fixed soon enough, revealing it is probably the best way to get their attention on the issue, I'd suggest giving them at least a week before doing so.
♫ dope veins with a gold chain ♫
Contact eBay directly regarding a flaw in one of there sites could be another option
I e-mailed them more than 2 weeks ago, and yeah actually what i will probably do is contacting e-bay, or maybe i will e-mail them again since i did it only once, maybe they missed it or something like that.
I have yet to find a webmaster that actually answers emails about vulnerabilities on his webpage. Some don't seem to care at all, even though anybody can access their whole database, others just fix the bug without even a simple "thank you". I mean come on... it's 30 seconds work to answer an email. Not really motivating to tell webmasters about vulns.....
(Feb 21, 2014 12:59 PM)SohnGottes Wrote: I have yet to find a webmaster that actually answers emails about vulnerabilities on his webpage. Some don't seem to care at all, even though anybody can access their whole database, others just fix the bug without even a simple "thank you". I mean come on... it's 30 seconds work to answer an email. Not really motivating to tell webmasters about vulns.....
Exactly what i thought, even if they didn't answer to me, i expected them to fix the issue, but they didn't, meh nevermind, i will find a way to contact them once more, if they ignore me again i will let it go.
🤝
Thanks for the answers.
Feb 21, 2014 05:18 PM
(This post was last modified: Feb 21, 2014 05:20 PM by g0han.)
Yeah they're never good with letting you know, found XSS in a government site and reported it and didn't get a thanks but they fixed the issue after a few days.. Guess the developers never want to admit to a mistake. Makes you not want to report them that's for sure, still will though
DO NOT DEAL WITH THIS MEMBER
these ass holes admin never get there job done correctly. i was in same situation . i mailed the admin but they not even replied with thankyou... these things kills motivation
If you're willing to give it another try at contacting them, then thats what I would do. If they don't reply or don't fix it, give it to the world.
(Feb 22, 2014 11:45 AM)rahool Wrote: these ass holes admin never get there job done correctly. i was in same situation . i mailed the admin but they not even replied with thankyou... these things kills motivation
I know right, found XSS on one of the biggest news paper in sweden, but ofc they didnt reply on the email :( But they fixed it lal, no reward and no thank you.
|
