Bug #7669

xscript XSS

Details

Request #7669	xscript XSS
Submitted	2006-05-19 05:53 UTC
From	info at otdyh dot ru
Status	Bogus
Package	DB_DataObject
PHP Version	4.3.11
OS	Linux
Roadmaps	(Not assigned)

Comments

[2006-05-19 05:53 UTC] info at otdyh dot ru

Description:
------------
Today i recieve a message from our hosting provider, what scripts have XSS injection, i didn't get such warnings before scripts is seems like this:
<img src=XSS@<xscript>XSS</xscript>.com alt="" title="" />
if an image would be contain a Xss commands it can be run after some time and injects user cookie or so on. May be you can make db escape to prevent such injection?

Test script:
---------------
showimage.php?src=XSS@<xscript>XSS</xscript>.com

Expected result:
----------------
<img src=XSS@<xscript>XSS</xscript>.com alt="" title="" />

Actual result:
--------------
<img src=XSS@<xscript>XSS</xscript>.com alt="" title="" />
but wanted to be
XSS@.com