Cross Site Scripting(XSS) in /html/index_done.php

[GoogleCodeExporter]

http://site.com/phurl/html/index_done.php?url=blah&short_url="></a><script>alert
(1);</script>

Causes javascript to be ran.

Original issue reported on code.google.com by itspa...@gmail.com on 26 Oct 2010 at 1:27

[GoogleCodeExporter]

must have registered globals on for this

Original comment by itspa...@gmail.com on 26 Oct 2010 at 3:13

[GoogleCodeExporter]

I'll put register globals as a requirement for the script. Thanks.

Original comment by hcblahb...@gmail.com on 26 Oct 2010 at 7:36

• Changed state: Done

[GoogleCodeExporter]

that is still lazy coding. because some hosters dont allow you to change the 
php settings.

i think you can set it by the script and .htaccess

but this specific file, you have it stripped, but then the next line, the same 
variable you dont.

I would just use a function that cycles thru all 
get/post/variable/session/cookie/request and clean for XSS

It is what all the big names do.

Original comment by itspa...@gmail.com on 26 Oct 2010 at 7:41

[GoogleCodeExporter]

Will look into it now.

Original comment by hcblahb...@gmail.com on 27 Oct 2010 at 10:55

• Changed state: Started

[GoogleCodeExporter]

Original comment by hcblahb...@gmail.com on 28 Oct 2010 at 12:11

• Changed state: Fixed