Bugtraq mailing list archives
Re: XSS in JAB Guest Book
From: "Steven M. Christey" <coley () mitre org>
Date: Thu, 7 Dec 2006 11:05:39 -0500 (EST)
function invalideregtest($input) script just check $topic by invalideregtest function
I think this function just *tries* to check inputs, but doesn't succeed. Did you do any live testing using $topic ? We should expect to see more erroneous cleansing/checking functions as programmers attempt to implement security in their products.
$checkcount = 0;
This matters later on.
//$exinput = str_split($input); $countname = count($exinput);
Since the assignment of $exinput is commented out, the variable is undefined. So, $countname is set to 0. (This was probably commented out because the function doesn't exist in PHP 4.)
for($i=0; $i<$countname; $i++) {
Since $countname is 0, this loop is not entered.
if($checkcount != 0) { $input = "no"; } else { $input = "yes"; }
Since $checkcount is 0, the function always returns "yes", meaning "the input looks valid to me." <SCRIPT>abc</SCRIPT> === yes ABCDE GHIF AKLSM === yes ABCDEGHIFAKLSM === yes There might be other logic errors in the function, but this is the most obvious one. - Steve
Current thread:
- XSS in JAB Guest Book nj (Dec 04)
- <Possible follow-ups>
- Re: XSS in JAB Guest Book Steven M. Christey (Dec 07)
- Re: XSS in JAB Guest Book Barnz (Dec 09)