XSS in versatility 4 ?
-
-
- chris1407
- Newbie
- Posts: 14
- Thanks: 0
-
i scanned my website with an vulnerability scanner. it gives me an high risk bug.
'malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them'
proof of concept:
_http://www.mysite.com/?fontstyle=1"+onmouseover=alert(664447827493)+
if you do this, a popup will open and shows you the numbers from the example. (664447827493)
what did you think ?
-
-
-
- Arifin FinLy
- Preeminent Rocketeer
- Posts: 17372
- Thanks: 18
-
Hello,
what software or script you used to scan your website?
Could you please provide your site link?
-
-
-
- chris1407
- Newbie
- Posts: 14
- Thanks: 0
-
my site:
www.infected-web.de/
i used acunetix scanner
acunetix.com
-
-
-
- Arifin FinLy
- Preeminent Rocketeer
- Posts: 17372
- Thanks: 18
-
Hello,
I still don't check with that scanner.
Could you please check whether the demo demo.rockettheme.com/nov08_j15/ also shows the same xss warning?
-
-
-
- chris1407
- Newbie
- Posts: 14
- Thanks: 0
-
check out this one. versatility 4 is not fixed yet.
www.rockettheme.com/forum/index.php?p=129721&rb_v=viewtopic
-
-
-
- Arifin FinLy
- Preeminent Rocketeer
- Posts: 17372
- Thanks: 18
-
Hello Chris,
I will ask and confirm this to the developer team. Thanks for heading this up.
-
-
-
- Andy Miller
- Preeminent Rocketeer
- Posts: 9919
- Thanks: 96
- Web Kahuna
-
Hi Chris, i'm not able to replicate this issue. I just installed the latest version of the Joomla 1.5 based RocketLauncher for Verstility4. Then i put this URL in the browser:
_http://localhost/demo/nov08/index.php?fontstyle=1+onmouseover=alert(664447827493)+
EDIT: Ok, missed a quote, I see it now. Strange. I'll take a look at it. For the record these types of XSS are generally considered LOW impact as they only run client side js.
-
-
-
- Andy Miller
- Preeminent Rocketeer
- Posts: 9919
- Thanks: 96
- Web Kahuna
-
Ok can you replace line 12 in rt_styleswitcher.php with this:
$$tprop = htmlentities(JRequest::getString($tprop, null, 'get'));
Should resolve it.
-
Time to create page: 0.076 seconds