Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I recently came across a website that generates a random adjective, surrounded by a prefix and suffix entered by the user. For example, if the user enters "123" for prefix, and "789" for suffix, it might generate "123Productive789". I've been screwing around with it, and I thought I might try something out. I entered this into the prefix field:

<a href="javascript:window.close();">Click</a><hr />

And, sure enough, I was given the link, then an <hr>, then a random adjective. What I'm wondering is, could this be dangerous? There must be many more websites out there that have this issue, are all of them vulnerable to some sort of php injection?

share|improve this question
    
Yes this is a major issue. Wiki page on it en.wikipedia.org/wiki/Code_injection and OWASP page on it owasp.org/index.php/Code_Injection –  AndyBursh Nov 27 '12 at 23:07
3  
It's actually the Javascript that's dangerous, as that is the part that can actually do anything. –  System Down Nov 27 '12 at 23:14
    
@SystemDown but Javascript is client-side, correct? –  tkbx Nov 27 '12 at 23:15
    
@tkbx - That is correct. But it can still be dangerous. See the answer below on XSS attacks. –  System Down Nov 27 '12 at 23:17
    
@SystemDown Well, if you can inject some Java applet in there and exploit a security vulnerability, that's pretty serious too. (Java might have some cross-site loading protection, which would mitigate this attack, though) –  luiscubal Nov 27 '12 at 23:31

1 Answer 1

up vote 7 down vote accepted

It would appear that this site is vulnerable to a cross-site scripting attack (XSS). XSS is a reasonably common and potentially significant security vulnerability.

Of course, what an attacker can accomplish by using an XSS attack will depend heavily on the nature of the site itself. An XSS vulnerability on a banking site is likely to lead to many more attacks than an XSS vulnerability on a toy web app that has no logins and has no user data.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.