bugtraq - Re: XSS in JAB Guest Book

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200612071605.kB7G5dNx013751@faron.mitre.org>
Date: Thu, 7 Dec 2006 11:05:39 -0500 (EST)
From: "Steven M. Christey" <coley@...re.org>
To: bugtraq@...urityfocus.com
Subject: Re: XSS in JAB Guest Book

>function invalideregtest($input)
>
>script just check $topic by invalideregtest function

I think this function just *tries* to check inputs, but doesn't
succeed.  Did you do any live testing using $topic ?

We should expect to see more erroneous cleansing/checking functions as
programmers attempt to implement security in their products.

>	$checkcount = 0;

This matters later on.

>	//$exinput = str_split($input);
>	$countname = count($exinput);

Since the assignment of $exinput is commented out, the variable is
undefined.  So, $countname is set to 0.

(This was probably commented out because the function doesn't exist in
PHP 4.)

>	for($i=0; $i<$countname; $i++)
>	{

Since $countname is 0, this loop is not entered.

>  if($checkcount != 0)
>  {
>  	$input = "no";
>  }
>  	else
>  {
>  	$input = "yes";
>  }

Since $checkcount is 0, the function always returns "yes", meaning
"the input looks valid to me."

  <SCRIPT>abc</SCRIPT> === yes

  ABCDE GHIF AKLSM === yes

  ABCDEGHIFAKLSM === yes

There might be other logic errors in the function, but this is the
most obvious one.

- Steve