Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:18291
HistoryOct 26, 2007 - 12:00 a.m.

usd250 helpdesk XSS vulnerabily.

2007-10-2600:00:00
vulners.com
21

http://www.oneorzero.com/

Within the helpdesk utility usd250, an XSS in the comments field is possible.
The comments strip script tags and replace them with (not allowed), but
script tags dont need to be in place for XSS. Something along the lines ofโ€ฆ
<b onmouseover="window.alert('omghax')">some text</b> Suffices.

The fix is to use htmlentities() or htmlspecialchars() to filter ALL html
from user input.