Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: Simple Machines Forum (SMF) XSS issue
From: mrapples () gmail com
Date: 21 Oct 2006 07:00:00 -0000

Good find on this.

Here is the fix I applied:

Find on line ~85 in Sources/Search.php:

foreach ($temp_params as $i => $data)
{
    @list ($k, $v) = explode('|\'|', $data);
    $context['search_params'][$k] = stripslashes($v);
}


Change to:

foreach ($temp_params as $i => $data)
{
    @list ($k, $v) = explode('|\'|', $data);
    $context['search_params'][$k] = RemoveXSS(stripslashes($v));
}


The RemoveXSS function is taken from the following site:
http://quickwired.com/kallahar/smallprojects/php_xss_filter_function.php

I hope that handles all the issue related to this.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault