bugtraq - Re: Re: IndonesiaHack Advisory HTML injection in PHP Fusebox

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060129144700.29781.qmail@securityfocus.com>
Date: 29 Jan 2006 14:47:00 -0000
From: pr1nce_empire@...oo.com
To: bugtraq@...urityfocus.com
Subject: Re: Re: IndonesiaHack Advisory HTML injection in PHP Fusebox


I don't think so, this is a vulneralability since the "scriptProtect" isn't applied to this variable
$FB_["rawFA"] = $attributes["fuseaction"];

simple example : 
I have "scriptProtect" like this :

function validate($char)
{
if(preg_match('/[\'\"%|*(){}~`!@#$;\\/=+-_^]/',$char))
die("We have received an error request\n<br>");
}

Then the URL "http://xxx.xx/test.php?msg=blablabla"

test.php like the following script is vulner because validate function isn't applied. 
<?php
$test=$_GET[msg];
echo "$test";
?> 

We can solve the problem by validating GET request like this :
$test=validate($_GET[msg]);

I think that this case is clear enough.

Cheers