search

ivannovak / jpmaster77-s-Login-System-

jpmaster77's Login System v2.0.4d
http://www.evolt.org/node/60384
Other
42 stars 28 forks source link

Critical! Internal mail is XSS vournable #7

Closed rainworm closed 13 years ago

rainworm commented 13 years ago

I found an issue in internal mail system. It allowes cross site scripting (XSS). Do I have to point out that this one is critical and should be fixed as soon as posible?

ivannovak commented 13 years ago

I'm going to add a cleanInput function to cycle through input data running it through htmlspecialchars. That should help :)

rainworm commented 13 years ago

I haven't checked your solution yet (I will do so soon), but avoiding special characters should do the job. :)