Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: e-commerce, shopping carts :: hack1243.htm

Alan Ward Acart XSS vulnerabilities in register.asp



XSS vulnerabilities in register.asp in Alan Ward Acart



Vulnerability:	XSS vulnerabilities in register.asp



Description:	The registration form in register.asp does not properly sanitize user input.  This means a malicious user can place script into the form fields when they register.  The script is stored in the database intact and is called and executed when the data is to be displayed.



Exploit:	The exploit was proven with a test script placed into several of the formís fields.

	<script>alert("test")</script>



Solution:	The developer needs to properly sanitize user input in the register.asp form.



Credit:	CyberArmy Application and Code Auditing Team

	Parag0d



The developer was contacted regarding this matter, but never gave a reply.


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH