Project

General

Profile

Actions
Copy link

Evolution #42

closed

XSS exploit on search

Added by Simon almost 15 years ago. Updated about 9 years ago.

Status:
Fermé
Priority:
Bas
Assignee:
Simon
Category:
public
Target version:
1.3
Start date:
Due date:
% Done:

0%

Estimated time:
Resolution:
fixed

Description

Discovered by 999éme Man

http://securityreason.com/exploitalert/6541

http://www.packetstormsecurity.org/0907-exploits/linea-xss.txt

Actions
Copy link
 #1

Updated by Simon almost 15 years ago

  • Status changed from Nouveau to Fermé
  • Resolution set to fixed

fixed r780

To fix it manually

line 26 in public/tpl_search.php replace

$str=$_REQUEST['search'];

by :

$str=strip_tags($_REQUEST['search']);
Actions
Copy link
 #2

Updated by Simon almost 15 years ago

The previous post is valid for 1.2.x versions only.

*For version 1.1, do the change on line 15! *

Actions
Copy link
 #3

Updated by Simon about 9 years ago

Update securityCheck() function

/**
 * securityCheck()
 * Test and sanitize user input
 * from request
 * @return boolean
 **/
function securityCheck() {

    $passed = true;

    // we first sanitize vars
    if(isset($_REQUEST['rub']))
        $_REQUEST['rub']= strip_tags($_REQUEST['rub']);
    if(isset($_REQUEST['search']))
        $_REQUEST['search']= strip_tags($_REQUEST['search']);
    if(isset($_REQUEST['name']))
        $_REQUEST['name']= strip_tags($_REQUEST['name']);
    if(isset($_REQUEST['newsletteremail']))
        $_REQUEST['newsletteremail']= strip_tags($_REQUEST['newsletteremail']);
    // then do tests
    if(isset($_REQUEST['id']) && preg_match('/[^0-9A-Za-z]/',$_REQUEST['id']))
        $passed= false;
    if(isset($_REQUEST['parentid']) && !is_numeric($_REQUEST['parentid']))
        $passed= false;
    if(isset($_REQUEST['parentparentid']) && !is_numeric($_REQUEST['parentparentid']))
        $passed= false;
    if(isset($_REQUEST['debut']) && !is_numeric($_REQUEST['debut']))
        $passed= false;

    if($passed == false) die('no way!');
    else return true;
}
Actions
Copy link

Also available in: Atom PDF