Bugtraq mailing list archives
Re: Re: IndonesiaHack Advisory HTML injection in PHP Fusebox
From: pr1nce_empire () yahoo com
Date: 29 Jan 2006 14:47:00 -0000
I don't think so, this is a vulneralability since the "scriptProtect" isn't applied to this variable $FB_["rawFA"] = $attributes["fuseaction"]; simple example : I have "scriptProtect" like this : function validate($char) { if(preg_match('/[\'\"%|*(){}~`!@#$;\\/=+-_^]/',$char)) die("We have received an error request\n<br>"); } Then the URL "http://xxx.xx/test.php?msg=blablabla" test.php like the following script is vulner because validate function isn't applied. <?php $test=$_GET[msg]; echo "$test"; ?> We can solve the problem by validating GET request like this : $test=validate($_GET[msg]); I think that this case is clear enough. Cheers
Current thread:
- IndonesiaHack Advisory HTML injection in PHP Fusebox king_purba (Jan 17)
- <Possible follow-ups>
- Re: IndonesiaHack Advisory HTML injection in PHP Fusebox brian428 (Jan 26)
- Re: Re: IndonesiaHack Advisory HTML injection in PHP Fusebox pr1nce_empire (Jan 30)