41–50 of 114 posts
While we are at it.. XSS search: https://github.com/search?q=extension%3Aphp+%3C%3F%3D%24_GET...
I can definitely see the issue if the server saves the unfiltered input and tries to print that out for other uses, but it seems to me that outputting a raw $_GET variable will only go to the requester and therefore could only run unfiltered code on that requesters machine.
EDIT: Answering my own question:
This is a security hole because the unsafe JavaScript is stored in the URL for the page (it is a GET parameter). This bad URL could then be sent as a link in a spam email or similar. Victims clicking on the link would then see a page that comes from the legitimate source, but is running unsafe code compromising that user's session. This sort of attack relies on the attacker distributing the link with the bad code as a URL parameter, and is not a vulnerability that a user could encounter when just visiting that site as I had first assumed.
While we are at it.. XSS search: https://github.com/search?q=extension%3Aphp+%3C%3F%3D%24_GET...
Is it an XSS if you can only make it output code to your own browser? I can already execute whatever JavaScript I want in the console, so what's the advantage of having the server deliver that code to (only) me? I can definitely see the issue if the server saves the unfiltered input and tries to print that out for other uses, but it seems to me that outputting a raw $_GET variable will only go to the requester and th…
There is a huge need in the space for a well marketed quality assurance contractor who can find problems like this and fix them. "We found these issues, and we can fix them all. Pay us for finding them or pay us some more for fixing them, too." sort of thing. Why don't you see QA shops popping up like this?
You'd need some pretty iron-clad liability waivers... if you miss something, you're opening yourself up for a "malpractice" sort of scenario.
Bigger issue is a market problem. People who need the help the most do not know they need it.
There is a huge need in the space for a well marketed quality assurance contractor who can find problems like this and fix them. "We found these issues, and we can fix them all. Pay us for finding them or pay us some more for fixing them, too." sort of thing. Why don't you see QA shops popping up like this?
You'd need some pretty iron-clad liability waivers... if you miss something, you're opening yourself up for a "malpractice" sort of scenario.
While we are at it.. XSS search: https://github.com/search?q=extension%3Aphp+%3C%3F%3D%24_GET...
Is it an XSS if you can only make it output code to your own browser? I can already execute whatever JavaScript I want in the console, so what's the advantage of having the server deliver that code to (only) me? I can definitely see the issue if the server saves the unfiltered input and tries to print that out for other uses, but it seems to me that outputting a raw $_GET variable will only go to the requester and th…
There is a huge need in the space for a well marketed quality assurance contractor who can find problems like this and fix them. "We found these issues, and we can fix them all. Pay us for finding them or pay us some more for fixing them, too." sort of thing. Why don't you see QA shops popping up like this?
While we are at it.. XSS search: https://github.com/search?q=extension%3Aphp+%3C%3F%3D%24_GET...
Nice example, but not all are insecure. For example, the second one here is: $result = mysql_query('DELETE FROM saves WHERE id = '.(int)$_GET['delete']);
That's an example of hazardously bad programming practices. You're one mistake away from complete disaster. You should be sure that it takes more than one mistake to expose you to that sort of risk. Casting to int is not a general purpose escaping system, and further, if you miss even one of these your entire application can be trashed. Using mysql_query at all is a sign there's something severely wrong with your app…
There is a huge need in the space for a well marketed quality assurance contractor who can find problems like this and fix them. "We found these issues, and we can fix them all. Pay us for finding them or pay us some more for fixing them, too." sort of thing. Why don't you see QA shops popping up like this?