360XSS: When Virtual Tours Take a Detour to the Dark Side
The 360XSS campaign exploits a cross-site scripting vulnerability in the Krpano framework, hijacking over 350 websites to serve spam ads. It’s like a digital slapstick comedy, where trusted domains unwittingly become the stage for sketchy ads, all while boosting SEO rankings. Krpano users, update ASAP to avoid being part of this farce!
Hot Take:
Ah, the classic tale of a vulnerability that just won’t quit! In a plot twist that’s part cyber thriller and part slapstick comedy, hackers have once again turned a virtual tour framework into a virtual horror show. It’s like giving a mischievous kid the keys to the candy store and hoping for the best. Spoiler alert: it didn’t end well for 350 websites.
Key Points:
- Over 350 websites, including government and Fortune 500 sites, were hit by the 360XSS campaign.
- The XSS vulnerability was found in the Krpano framework used for virtual tours.
- Malicious actors used the flaw to manipulate search results and spread spam ads.
- The vulnerability involved an XML parameter that allowed malicious scripts to execute.
- Krpano has since released an update to mitigate the risk of such XSS attacks.
Already a member? Log in here