Hello,
i've found an XSS on a well-known site, the XSS is in the index page which has nothing to do with infection but there is a forum on an add-on domain like this :
index page : http://site.com/s=XSS
forum : http://site.com/forum
my question is : can i use XSS to ask the user post some topics in the forum, i think the post request in ajax will be somethings like :
################################
url="/forum/add.php?id=new post"
################################
is this possible ? , if so, will any kinds of forum be victim of XSS with a XSS bug in the main page ?
Thx

As long as the user is logged into the forum it should succeed as they are both on the same domain.


-Matt