10043—User Controllable JavaScript Event (XSS)

PUBLISHEDsecurity alertInformational

Passive

Metadata

Alert ID:: 10043
Risk:: Informational
Type:: Passive
CWE:: CWE-20Improper Input Validation

摘要

This check looks at user-supplied input in query string parameters and POST data to identify where certain HTML attribute values might be controlled. This provides hot-spot detection for XSS (cross-site scripting) that will require further review by a security analyst to determine exploitability.

解决方案

Validate all input and sanitize output it before writing to any Javascript on* events.

其他信息

User-controlled javascript event(s) was found. Exploitability will need to be manually determined. The page at the following URL: http://example.com/i.php?place=moon&name=Foo includes the following Javascript event which may be attacker-controllable: User-input was found in the following data of an [onerror] event: foo The user input was: foo

参考

browse all alerts