Bugtraq mailing list archives
Re: Simple Machines Forum (SMF) XSS issue
From: mrapples () gmail com
Date: 21 Oct 2006 07:00:00 -0000
Good find on this. Here is the fix I applied: Find on line ~85 in Sources/Search.php: foreach ($temp_params as $i => $data) { @list ($k, $v) = explode('|\'|', $data); $context['search_params'][$k] = stripslashes($v); } Change to: foreach ($temp_params as $i => $data) { @list ($k, $v) = explode('|\'|', $data); $context['search_params'][$k] = RemoveXSS(stripslashes($v)); } The RemoveXSS function is taken from the following site: http://quickwired.com/kallahar/smallprojects/php_xss_filter_function.php I hope that handles all the issue related to this.
Current thread:
- Simple Machines Forum (SMF) XSS issue josecarlos . norte (Oct 20)
- <Possible follow-ups>
- Re: Simple Machines Forum (SMF) XSS issue mrapples (Oct 21)
- Re: Simple Machines Forum (SMF) XSS issue RSnake (Oct 23)