The following warnings occurred:
Warning [2] Undefined array key "avatartype" - Line: 783 - File: global.php PHP 8.1.27 (Linux)
File Line Function
/global.php 783 errorHandler->error
/printthread.php 16 require_once
Warning [2] Undefined array key "avatartype" - Line: 783 - File: global.php PHP 8.1.27 (Linux)
File Line Function
/global.php 783 errorHandler->error
/printthread.php 16 require_once
Warning [2] Undefined variable $newpmmsg - Line: 40 - File: global.php(841) : eval()'d code PHP 8.1.27 (Linux)
File Line Function
/global.php(841) : eval()'d code 40 errorHandler->error
/global.php 841 eval
/printthread.php 16 require_once
Warning [2] Undefined array key "style" - Line: 909 - File: global.php PHP 8.1.27 (Linux)
File Line Function
/global.php 909 errorHandler->error
/printthread.php 16 require_once
Warning [2] Undefined property: MyLanguage::$lang_select_default - Line: 5024 - File: inc/functions.php PHP 8.1.27 (Linux)
File Line Function
/inc/functions.php 5024 errorHandler->error
/global.php 909 build_theme_select
/printthread.php 16 require_once
Warning [2] Undefined array key "additionalgroups" - Line: 7162 - File: inc/functions.php PHP 8.1.27 (Linux)
File Line Function
/inc/functions.php 7162 errorHandler->error
/inc/functions.php 5044 is_member
/global.php 909 build_theme_select
/printthread.php 16 require_once
Warning [2] Undefined array key 1 - Line: 1415 - File: inc/functions.php PHP 8.1.27 (Linux)
File Line Function
/inc/functions.php 1415 errorHandler->error
/inc/functions.php 1370 fetch_forum_permissions
/printthread.php 76 forum_permissions
Warning [2] Undefined array key "showimages" - Line: 160 - File: printthread.php PHP 8.1.27 (Linux)
File Line Function
/printthread.php 160 errorHandler->error
Warning [2] Undefined array key "showvideos" - Line: 165 - File: printthread.php PHP 8.1.27 (Linux)
File Line Function
/printthread.php 165 errorHandler->error
Warning [2] Undefined array key "showimages" - Line: 160 - File: printthread.php PHP 8.1.27 (Linux)
File Line Function
/printthread.php 160 errorHandler->error
Warning [2] Undefined array key "showvideos" - Line: 165 - File: printthread.php PHP 8.1.27 (Linux)
File Line Function
/printthread.php 165 errorHandler->error



Form Tools
Non-persistent Cross-Site Scripting Vulnerability - XSS - Printable Version

+- Form Tools (https://forums.formtools.org)
+-- Forum: Form Tools (https://forums.formtools.org/forumdisplay.php?fid=1)
+--- Forum: General Discussion (https://forums.formtools.org/forumdisplay.php?fid=5)
+--- Thread: Non-persistent Cross-Site Scripting Vulnerability - XSS (/showthread.php?tid=59)

Non-persistent Cross-Site Scripting Vulnerability - XSS - tropical - Mar 15th, 2009

Hi,

I am using Form Tools 1.x together with a SSL connection to collect personal information from an online form. A few weeks ago, I did a PCI audit scan and the results noted a security warning referred to as CGI abuses: XSS, or that the login page (index.php) for Form Tools had a "Non-persistent Cross-Site Scripting Vulnerability".

I would like to know whether there is a fix for this in FT 2.0? Also, how can this be fixed in the current stable version of FT 1.x?

Cheers,

Joseph

RE: Non-persistent Cross-Site Scripting Vulnerability - XSS - Ben - Mar 16th, 2009

Hi Joseph,

Hmmm! I really don't think this is a problem.

To prevent XSS / code injection attacks, PHP best practices recommend using calling mysql_real_escape_string() on incoming values prior to using them in any DB queries. This is what FT2 does (and I think FT1, too). It wards against these type of attacks.

Hope this info helps.

If you're still worried, would it be possible to get some more details? Perhaps an illustration of such a hack could take place (email it to me, rather than post it here!). Security problems are always a BIG concern, so I'll be sure to address it first.

- Ben