<<< Date Index >>>     <<< Thread Index >>>

XSS vulnerabilities in register.asp in Alan Ward Acart


Vulnerability:  XSS vulnerabilities in register.asp

Description:    The registration form in register.asp does not properly 
sanitize user input.  This means a malicious user can place script into the 
form fields when they register.  The script is stored in the database intact 
and is called and executed when the data is to be displayed.

Exploit:        The exploit was proven with a test script placed into several 
of the form?s fields.
        &lt;script&gt;alert("test")&lt;/script&gt;

Solution:       The developer needs to properly sanitize user input in the 
register.asp form.

Credit: CyberArmy Application and Code Auditing Team
        Parag0d

The developer was contacted regarding this matter, but never gave a reply.