BING.COM is prone to a XSS vulnerability because the application fails
to properly perform adequate boundary checks on user-supplied data.
An attacker can exploit this issue to execute arbitrary code in the
victim's browser.
Details
The reflected XSS vulnerability is a variant of a cross-site scripting
flaw: it occurs when the data provided by the attacker is exectued by
the browser, and then displayed on "normal" pages returned to other
users in the course of regular browsing, without proper HTML escaping. A
classic example of this is with online message boards where users are
allowed to post HTML formatted messages for other users to read
Vulnerabilit Details:
- Name : XSS Reflected on BING.COM
- Vulnerability Type : XSS Reflected
- Severity : Very High
- Researcher : Juan Sacco (runlvl)
- Vulnerable Link: here
The vulnerability is caused by the following code and affected by the
Generate Code map
<div id="LME_mapLinks" style="line-height: 20px">
<a id="LME_largerMap" //-->">'> on Bing Maps (New
window)">View Larger Map</a>
</div>
Credits
Manual discovered by Insecurity Research Labs
Juan Sacco (runlvl) - http://www.insecurityresearch.com
 exposed XSS vulnerability in Bing.com Maps){kind=link}