[ZendTo] XSS

[Brian Pocock]

What version of Zend.to are you running? There is a known XSS in an earlier version of code.

Brian Pocock - Consultant
Nebulas

On 1 Mar 2016, at 22:14, Keith Erekson <kbe2 at lehigh.edu<mailto:kbe2 at lehigh.edu>> wrote:


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Tested on Mac OS X 10.10, seems to work in Firefox (41 and 44), but not Chrome (48) nor Safari (9).

(pickup.php, not pickup/php for anyone who wants to try)

~Keith

On 03/01/2016 02:14 PM, Chris Venter wrote:
> Hi
>
> Our security audit has highlighted a possible reflected cross site scripting error on the pickup.php page,to test we ran
>
> https://server_name/pickup/php?emailAddr=test" /><script>alert('XSS Test')</script>
>
> Can anyone else confirm if this is an issue?
>
> Thanks
> CJ
>
>
> _______________________________________________
> ZendTo mailing list
> ZendTo at zend.to<mailto:ZendTo at zend.to>
> http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQEcBAEBCAAGBQJW1hMwAAoJEMdFVhhDm2SFxyEH+wVvzU2y4/Th4oMZKZruI+cb
At3pe8Sh/pEbMYgLUr7jpnuRKMPXs2Q+W7r0f9m/7P8s0TYWsfpOBhW7v2FC7uQ5
wep0NfZUByqFZpARocE9WB/2zRxh6oxOOy1RCcZjjnCNKBF2aVBvJUF7kfl2O57O
CwsWnXfosMNwBOsLTWzbSaV+FsoPLX4Ow5RH/cI1eBd64TLxOr+tmIsXatp+vua7
dtilpqxehF1REMyZyJx0e6u2pTdrsFJ5HoPinkk8GbsS2Q+hFfctan7NMsUr2gdP
BBmnSlSvAd3nzlFhlSApIA/+JbfSD6eooDcUxxNWJhWZP32s31+uTcg+OyIJWf8=
=tpYG
-----END PGP SIGNATURE-----

_______________________________________________
ZendTo mailing list
ZendTo at zend.to<mailto:ZendTo at zend.to>
http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto
Company name: Nebulas Solutions Group Ltd Company Registration Number: 04281153 Place of Registration: England and Wales Registered Office Address: 256 Waterloo Road, London, SE1 8RF
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ecs.soton.ac.uk/pipermail/zendto/attachments/20160302/2e1a1182/attachment.html