bugtraq - XSS vulnerabilities in register.asp in Alan Ward Acart

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20031204061117.5433.qmail@sf-www3-symnsj.securityfocus.com>
Date: 4 Dec 2003 06:11:17 -0000
From: <parag0d@...eaker.net>
To: bugtraq@...urityfocus.com
Subject: XSS vulnerabilities in register.asp in Alan Ward Acart

Vulnerability:	XSS vulnerabilities in register.asp

Description:	The registration form in register.asp does not properly sanitize user input.  This means a malicious user can place script into the form fields when they register.  The script is stored in the database intact and is called and executed when the data is to be displayed.

Exploit:	The exploit was proven with a test script placed into several of the form’s fields.
	&lt;script&gt;alert("test")&lt;/script&gt;

Solution:	The developer needs to properly sanitize user input in the register.asp form.

Credit:	CyberArmy Application and Code Auditing Team
	Parag0d

The developer was contacted regarding this matter, but never gave a reply.