0

I can see that browsing url like this

https://www.anywebsite.com/?p=%3Cscript%3Ealert(document.cookie)%3C/script%3E

shows alert into browser window.

Is their any way to prevent it ? its XSS.

Improve this question
5
  • 1
    I can confirm that by default this doesn't happen. I can conclude that this has something to do with tour custom code. I assume that p parameter is paging for something and I assume it should be an integer. Change your code that reads this parameter and convert it to int. Or better yet, if you are printing it somewhere make sure you escape the values (stip_tags for example if you don't want tags in there)
    – Marius ♦
    Sep 23, 2020 at 7:26
  • Hi , Glad to see your response @Marius, it's not just alert into browser but also add script into Html also & its appear in page as well.
    – Hamendra Sunthwal
    Sep 23, 2020 at 7:31
  • Hello @Marius i can see in network tab that it contains p = %3Cscript%3Ealert(document.cookie)%3C/script%3E As query parameters but i am not able to find out where i am printing it, any thoughts ?
    – Hamendra Sunthwal
    Sep 23, 2020 at 10:30
  • 1
    this means it might be safe. if it does not get shown anywayre in the page you might be save from xss
    – Marius ♦
    Sep 23, 2020 at 11:35
  • Thankyou @Marius It's fixed using intval($_GET['p'])
    – Hamendra Sunthwal
    Sep 23, 2020 at 11:36

1 Answer 1

Reset to default
1

As mentioned in the comments

I can confirm that by default this doesn't happen. I can conclude that this has something to do with tour custom code. I assume that p parameter is paging for something and I assume it should be an integer. Change your code that reads this parameter and convert it to int. Or better yet, if you are printing it somewhere make sure you escape the values (stip_tags for example if you don't want tags in there)

If the script tag is not printed anywhere, this means that it is escaped somehow and you are safe from XSS

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.