Non-persistent Cross-Site Scripting Vulnerability - XSS

[tropical]

Hi,

I am using Form Tools 1.x together with a SSL connection to collect personal information from an online form. A few weeks ago, I did a PCI audit scan and the results noted a security warning referred to as CGI abuses: XSS, or that the login page (index.php) for Form Tools had a "Non-persistent Cross-Site Scripting Vulnerability".

I would like to know whether there is a fix for this in FT 2.0? Also, how can this be fixed in the current stable version of FT 1.x?

Cheers,

Joseph

[Ben]

Hi Joseph,

Hmmm! I really don't think this is a problem.

To prevent XSS / code injection attacks, PHP best practices recommend using calling mysql_real_escape_string() on incoming values prior to using them in any DB queries. This is what FT2 does (and I think FT1, too). It wards against these type of attacks.

Hope this info helps.

If you're still worried, would it be possible to get some more details? Perhaps an illustration of such a hack could take place (email it to me, rather than post it here!). Security problems are always a BIG concern, so I'll be sure to address it first.

- Ben