Webboard: Reflective XSS

[email protected] 5 Dec 2009 15:38:46 -0000

Newsgroups	gmane.comp.web.mnogosearch.general
Message-ID	<[email protected]>

Author: Alexander Barkov
Email: 
Message:
Hi,



> Hi.

> I have a problem with xss in IE using some search strings, for example:

> http://www.somesite.com/cgi-bin/search.cgi?q=0&>"><script>alert(123)</script><"=Search!

> Is this a known problem or I have to tune some of my configs?

> Thanks.



- Which version of mnoGoSearch are you using?



- Does this happen with the default template?



- Make sure that you have HTML escaping in all places

where you display the variable 'q'.



I.e. this is unsafe:



$(q)



This is safe:



$&(q)



- Feel free to send your template for review to

  [email protected]





Reply: <http://www.mnogosearch.org/board/message.php?id=21008>