[VIM] Insanity checking in JAB Guest Book?
Steven M. Christey
coley at mitre.org
Thu Dec 7 11:07:57 EST 2006
[sent to Bugtraq]
Ref: XSS in JAB Guest Book
Researcher claims $topic is checked, but the checking function seems
>script just check $topic by invalideregtest function
I think this function just *tries* to check inputs, but doesn't
succeed. Did you do any live testing using $topic ?
We should expect to see more erroneous cleansing/checking functions as
programmers attempt to implement security in their products.
> $checkcount = 0;
This matters later on.
> //$exinput = str_split($input);
> $countname = count($exinput);
Since the assignment of $exinput is commented out, the variable is
undefined. So, $countname is set to 0.
(This was probably commented out because the function doesn't exist in
> for($i=0; $i<$countname; $i++)
Since $countname is 0, this loop is not entered.
> if($checkcount != 0)
> $input = "no";
> $input = "yes";
Since $checkcount is 0, the function always returns "yes", meaning
"the input looks valid to me."
<SCRIPT>abc</SCRIPT> === yes
ABCDE GHIF AKLSM === yes
ABCDEGHIFAKLSM === yes
There might be other logic errors in the function, but this is the
most obvious one.
More information about the VIM