Etomite Security Announcements Etomite Security Announcements Forum http://www.etomite.com/index.php Mon, 18 Feb 2008 20:36:55 +0000 5 Etomite Security Announcements http://www.etomite.com/skin_acp/IPB2_Standard/images/rss.png http://www.etomite.com/index.php Reported Potential XSS Exploit http://www.etomite.com/topic/7647-reported-potential-xss-exploit/ THE threat... If the server that Etomite is running on has proper security measures in place then there is no threat... If, however, the server doesn't have proper security measures in place then many PHP scripts are potentially exploitable...

The threat itself was inaccurately described and it took me a while to figure out exactly what was going on... Alerts were stating that the $_SERVER['PHP_INFO'] variable, which doesn't even exist, is the culprit... The variable in question is actually $_SERVER['PHP_SELF']... If anyone wants to insure that their system is not vulnerable to exploit attempts they can do so be simply adding the following line into their index.php parser file... I have tested Etomite with this line both as the first line of code, directly below the opening <?php tag as well as at the bottom of the script, directly above the comment line // first, set some settings, and do some stuff and both work equally well... At the top of the script is probably the easiest...

$_SERVER["PHP_SELF"] = htmlentities($_SERVER["PHP_SELF"]);


While the potential for Cross Server Scripting is somewhat remote, it can't hurt to have this extra line of code in place... The link to the best, yet still inaccurate, explanation is located at http://www.securityfocus.com/archive/1/488122 for anyone interested...

While only a remote possibility, I cannot assure anyone that this patch will not have potentially adverse effects on snippet functionality... I have been running tests on my development sites, only one of which is open to the vulnerability, and have had no problems as of yet...]]> Mon, 18 Feb 2008 20:36:55 +0000 http://www.etomite.com/topic/7647-reported-potential-xss-exploit/ Subscribe to Announcements http://www.etomite.com/topic/6300-subscribe-to-announcements/
To Subscribe,
Click Here to Subscribe to Etomite Security Announcements by Email
Click Here to Subscribe to Etomite Security Announcements by RSS]]> Tue, 07 Nov 2006 09:00:38 +0000 http://www.etomite.com/topic/6300-subscribe-to-announcements/