| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: 22 Oct 2007 22:37:20 -0000
From: Joseph.giron13@...il.com
To: bugtraq@...urityfocus.com
Subject: usd250 helpdesk XSS vulnerabily.
http://www.oneorzero.com/
Within the helpdesk utility usd250, an XSS in the comments field is possible.
The comments strip script tags and replace them with (not allowed), but
script tags dont need to be in place for XSS. Something along the lines of...
<b onmouseover="window.alert('omghax')">some text</b> Suffices.
The fix is to use htmlentities() or htmlspecialchars() to filter ALL html
from user input.
Powered by blists - more mailing lists