Malaysia's Largest bank exposed Paul Graham Transaction back in Viaweb era(maybank2u.com.my)

maybank2u.com.my

Malaysia's Largest bank exposed Paul Graham Transaction back in Viaweb era

https://www.maybank2u.com.my/mbb/m2u/jsp/common/mbbReceipt.jsp?transactionType=Favourite+3rd+Party+Transfer&status=Successful&fromAccountDisplay=543192003263+CA&amount=RM9637.00&referenceView=11012679873&other=%3Ctr%3E%3Ctd%3ETo+Open+3rd+Party+Account+%3A%3C%2Ftd%3E%3Ctd%3E%26nbsp%3B%3Cstrong%3E104795821078+VIAWEB+INC.%3C%2Fstrong%3E%3C%2Ftd%3E%3C%2Ftr%3E%3Ctr%3E%3Ctd%3E3rd+Party+Email+Address+%3A%3C%2Ftd%3E%3Ctd%3E%26nbsp%3B%3Cstrong%3Epg%40viaweb.com%3C%2Fstrong%3E%3C%2Ftd%3E%3C%2Ftr%3E%3Ctr%3E%3Ctd%3EAccount+Holder+Name+%3A%3C%2Ftd%3E%3Ctd%3EGraham, Paul

4 comments

teej16 anni fa

Very funny. Nice XSS find.

swwu16 anni fa

Doesn't strip script tags or anything; lots of nasty stuff you could do with this. Somebody should notify them.

https://www.maybank2u.com.my/mbb/m2u/jsp/common/mbbReceipt.j...

askar_yu16 anni fa

didn't notice that right away, nice catch :)

diehell16 anni fa

Ah...my country stuff on HNews... Nice...

mahmud16 anni fa

At least your country is not "the perfect failed state" :-|

http://news.ycombinator.com/item?id=1358503

I was prepared for a morning of Lisp hacking, product development, and email blasts when I woke up to that. FFFFUUUUU!

diehell16 anni fa

Wait till the oil run out.. ;)

[deleted]16 anni fa

mahmud16 anni fa

I always wanted a bank with an API ;-)