New Vulnerabilities

[Guest]

Hello every one sorry i dont knwo if it is new or not or if everyone know anything about it or no any way check this link

K-otik

and this is an example

 

this is an exampl

http://www.yoursite.com/catalog(or where ever your package is installed/contact_us.php?&name=1&email=1&enquiry=%3C/textarea%3E%3Cscript%3Ealert('w00t');%3C/script%3E

[Guest]

I suggest everyone disable the contact us or do something else i dont know i am working on it see if i can find a solution for it but in the mean time watch out because i test it and it worked

[Guest]

Hello Hamed,

 

Please explain what this vulnerability does, why it is important to store owners, and also how it could be used to comprise the website.

 

Keep in mind that this is a loaded question since I already know the answer...I just want to know if you do as your recommendation seems a bit harsh.

 

Bobby

[Guest]

ok fair enough if you know the answer then good luck other wise contact my via pm then, but it will let the attacker to use the code and run a remote code on your website which will lead the attacker to for example download your database or damage your data and keep in mind i test it on my test website and it did work.

[pigames]

Can't you just add $enquiry=""; to the top of the page?

[pigames]

Can't you just add  $enquiry="";  to the top of the page?

<{POST_SNAPBACK}>

Actually I see why not. This seems to work for me:

 

$oldEnquiry =$HTTP_POST_VARS['enquiry'];

$enquiry="";

$enquiry = $oldEnquiry;

[papier]

Just change it to an input box. They don't allow for scripts to be run, even though they are single lined.

[Guest]

thanks to yesudo it is fixed but i manage to fix it by my self but again very thanks to yesudo this is the link for the fix

http://www.oscommerce.com/community/contri...l/search,emmett

[stevel]

Previous discussion with fix