I recently came across a website that generates a random adjective, surrounded by a prefix and suffix entered by the user. For example, if the user enters "123" for prefix, and "789" for suffix, it might generate "123Productive789". I've been screwing around with it, and I thought I might try something out. I entered this into the prefix field:

<a href="javascript:window.close();">Click</a><hr />

And, sure enough, I was given the link, then an <hr>, then a random adjective. What I'm wondering is, could this be dangerous? There must be many more websites out there that have this issue, are all of them vulnerable to some sort of php injection?

  • Yes this is a major issue. Wiki page on it en.wikipedia.org/wiki/Code_injection and OWASP page on it owasp.org/index.php/Code_Injection – Andy Hunt Nov 27 '12 at 23:07
  • 3
    It's actually the Javascript that's dangerous, as that is the part that can actually do anything. – System Down Nov 27 '12 at 23:14
  • @SystemDown but Javascript is client-side, correct? – tkbx Nov 27 '12 at 23:15
  • @tkbx - That is correct. But it can still be dangerous. See the answer below on XSS attacks. – System Down Nov 27 '12 at 23:17
  • @SystemDown Well, if you can inject some Java applet in there and exploit a security vulnerability, that's pretty serious too. (Java might have some cross-site loading protection, which would mitigate this attack, though) – luiscubal Nov 27 '12 at 23:31

It would appear that this site is vulnerable to a cross-site scripting attack (XSS). XSS is a reasonably common and potentially significant security vulnerability.

Of course, what an attacker can accomplish by using an XSS attack will depend heavily on the nature of the site itself. An XSS vulnerability on a banking site is likely to lead to many more attacks than an XSS vulnerability on a toy web app that has no logins and has no user data.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.