0

Users/Testers in my website are able to execute scripts via url using third party tool

So the tool is running and you enter http://yoursite.com?q=nokia188413544056">alert(document.cookie);16cd1a0b206

Then browser executes the alert in the url but not without tool.

I am using codeigniter/twig. Twig escaping does not work in case burpsuit tool is running.

However if normal scenario twig outputs the following escaped values and script in url does not execute. search?query=nokia188413544056%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E16cd1a0b206

I am able to reproduce the same on IE after disabling the xss filter using internet option of IE.

However I have verified multiple times that we are striping tags and filtering all url parameters.

Can somebody guide me as what could be the reason, or is it even a valid case.

NOTE: I can provide more and more details out put of every step if needed.

2
  • It looks as though you are trying getting the values through GET vars. You could try XSS filter through the $this->input->get("name", true); <- noticed the second param, this will enable XSS filtering for the specified name/value pair. Alt you could enable global filtering in the config.php
    – mic
    Mar 10, 2014 at 10:51
  • @micb So I checked, and you are correct but in server side code, it is trying to get current url using $_SERVER['REQUEST_URI'] which we are printing on our twig templates by setting template variables. I want to know is there any codeigniter way of fetching this value(xss filtered). Mar 10, 2014 at 10:55

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.