bugGnuheter - Bugs: bug #2895, header.php XSS

 
 

bug #2895: header.php XSS

Submitter:  Invalid User ID <#5588>
Submitted:  Sat 22 Mar 2003 10:31:13 AM UTC
   
 
Category:  Bug Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 22 Mar 2003 10:31:13 AM UTC, original submission:  

header.php har ett Cross-Site Scripting-problem, som visar sig exempelvis i följande URL:

http://gnuheter.org/stats.php?config=1&meta_keywords=%22%3e%3cscript%3ealert%2857%29%3c%2fscript%3e%3cqwe+%22

Även andra skript än stats.php drabbas av detta.

Problemet beror på en rad i header.php:

if (!isset($config)) include('config.php');

som istället borde skrivas:

include_once('config.php');

Samma problem finns på fler ställen i koden. Någon ambitiös människa skulle ju kunna byta ut en massa if (!isset($x)) include() till include_once().

Invalid User ID <#5588>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

 

No changes have been made to this item

Back to the top

Powered by Savane 3.13-4448.
Corresponding source code