Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: Blogs :: tb10088.htm

Mephisto blog is vulnerable to XSS



Mephisto blog is vulnerable to XSS
Mephisto blog is vulnerable to XSS



Hello everyone!

Current bleeding-edge version of Mephisto blog is vulnerable to XSS.  
Comment's author name accept javascript code. If admin approves/ 
rejects comments manually, he have to load all unapproved comments,  
so it's possible to fetch his session id.

Example

Add new comment with the following author name: 
Then from admin's overview section check this comment - you'll see  
message with cookie.
If you manually approve your comments, check list of pending comments.

How to fix it

patch for /app/helpers/application_helper.rb :

5c5
<     return comment.author if comment.author_url.blank?
---
 >     return h(comment.author) if comment.author_url.blank?

Best wishes!
Sergey Tikhonov


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH