Webboard: Reflective XSS

[email protected] 16 Dec 2009 13:50:41 -0000

Newsgroups	gmane.comp.web.mnogosearch.general
Message-ID	<[email protected]>

Author: Alexander Barkov
Email: 
Message:
> I see now that the problem is reproduced everywhere.

> Suppose we have a new empty web-site.

> Create a simple html-file:

> <html><head></head>

> <body><p>WHAT</body>

> </html>

> Then fill your database using "indexer".

> Then make the request: http://localhost/cgi-bin/search.cgi?q=who&>"><script>alert(123)</script><"=Search!

> We don't have the word "who". It's OK.

> And now make the request: http://localhost/cgi-bin/search.cgi?q=what&>"><script>alert(123)</script><"=Search!

> We HAVE the word "what" and we've got alert messages.



This problem was fixed in the upcoming 3.3.10 release.

Thanks for reporting!



You can download the current 3.3.10 sources from here:

http://www.mnogosearch.org/Download/mnogosearch-3.3.10.tar.gz



(the file will be replaced when the final 3.3.10 release is available)





Reply: <http://www.mnogosearch.org/board/message.php?id=21032>