AOH :: HP Unsorted S :: BX3080.HTM

Sphider 1.3.4 Cross Site Scripting
Sphider 1.3.4 Cross Site Scripting
Sphider 1.3.4 Cross Site Scripting

Hash: SHA1

Sphider Cross Site Scripting Vulnerability

Original release date: 2008-04-29
Last revised: 2008-05-06
Latest version:
Source: Christian Holler 

Systems Affected:

Sphider 1.3.4 ( - A PHP Search Engine

Severity: Moderate


 Sphider is a search engine that has several features; one is a search suggestion
 feature as in "Did you mean xyz?" that corrects possible typos in your search,
 without however sanitizing this output. This feature is off by default, but
 turned on by many sites for convenience.

I. Description

 The output of the suggestion feature in Sphider does output the complete query
 if there is at least one word in this query that has the script has found a
 possible correction for. This word is highlighted and the rest of the search
 query is returned as it is. However, this output is completely unsanitized,
 allowing HTML/Javascript to be included.

II. Impact

 Depending on the site where this search script is deployed, this attack can be
 used to steal cookies from other users by tricking them into visiting a given

III. Proof of concept


 where the first word in the query, "xsss" is a word that can be corrected by
 the search script. This generally depends on the indexed site(s) but such a
 word is very easy to find.

IV. Solution

 Currently none, author has been informed.


 2008-04-29: Author informed
 2008-05-06: Vulnerability notice published

Version: GnuPG v2.0.6 (GNU/Linux)


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to