admin login page possible XSS vulnerability
Posted: Mon Aug 14, 2006 11:17 am
See http://www.informit.com/articles/articl ... 03037&rl=1 for further info.
The admin login page appears to potentially be vulnerable to a similar exploit as detailed in the above url.
For example, if one enters the following:
lja" />Hello tag (with id of x) into the page.
This exploit is very similar to the one in the above url, and before someone says the size=15 limit will fix the problem, note that the input field that was exploited in the above url was a 25 character limit. Note, also, that there are javascriptlets that will remove size limits on input fields in the browser, allowing an unlimited amount of text to be injected, potentally leading to the exploit from the url ablve.
The fix, the same as in the url above, the contents of the username and password fields should be filtered to remove bad characters (or better yet, filtered to only allow known good characters) before being repeated back to the page. Not only that, but the password field should not be repeated back to the page, the user should have to retype the password again if they got something wrong with the userid/password combo.
The admin login page appears to potentially be vulnerable to a similar exploit as detailed in the above url.
For example, if one enters the following:
lja" />Hello tag (with id of x) into the page.
This exploit is very similar to the one in the above url, and before someone says the size=15 limit will fix the problem, note that the input field that was exploited in the above url was a 25 character limit. Note, also, that there are javascriptlets that will remove size limits on input fields in the browser, allowing an unlimited amount of text to be injected, potentally leading to the exploit from the url ablve.
The fix, the same as in the url above, the contents of the username and password fields should be filtered to remove bad characters (or better yet, filtered to only allow known good characters) before being repeated back to the page. Not only that, but the password field should not be repeated back to the page, the user should have to retype the password again if they got something wrong with the userid/password combo.