Zen Follower
- Join Date:
- Oct 2005
- Posts:
- 160
- Plugin Contributions:
- 0
another PCI compliance problem
My site is : http://www.mishobonsai.com
I am tested by mcafeesecure and they reported a vulnerability recently that prevent me from being pci compliant.
They have tried this url:
http://www.mishobonsai.com/news/archive/?>"><script>alert(123)</script ><"
and they say it return as valid.
in IE6 it doesn do anything except a blank archive page.
while in IE7 it trigger the xss script filter.
Macfeesecure calls this problem:
Web Application Cross Site Scripting
Cross Site Scripting (XSS)
The suggested fix is:
When accepting user input ensure that you are HTML encoding potentially malicious characters if you ever display the data back to the client.
Ensure that parameters and user input are sanitized by doing the following:
Remove < input and replace with <
Remove > input and replace with >
Remove ' input and replace with '
Remove " input and replace with "
Remove ) input and replace with )
Remove ( input and replace with (
