We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

found this: NASLDB: MODx CMS Detection / MODx SearchHighlight plugin XSS ??

    • 26931
    • 2,314 Posts
    anonymized-26931 Reply #1, 16 years, 5 months ago
    hi everybody,

    found this on Twitter: http://twitter.com/scipblogbot

    NASLDB: MODx CMS Detection: http://www.scip.ch/?nasldb.46182
    NASLDB: MODx SearchHighlight plugin XSS: http://www.scip.ch/?nasldb.46183

    does anyone know what these are used for? could this also be used for bad things undecided

    thanks, j
      • 25663 MODX Staff
      • 12,272 Posts
      Ryan Thrash Reply #2, 16 years, 5 months ago
      The first looks for the manager directory and the content of the login page, starting with:
      <title>MODx CMF Manager Login</title>

      It also includes the instructions to login, so if you’re not running a site in English or if you change the title tag, this technique won’t work.

      I believe the second was fixed with 1.0.3 release via the AjaxSearch version included there.

      Chain both together and tweak the second one and you could have problems indeed if you’re running an un-patched version of MODx.
        Ryan Thrash, MODX Co-Founder
        Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
        • 26931
        • 2,314 Posts
        anonymized-26931 Reply #3, 16 years, 5 months ago
        thanks Ryan,

        zeeeeeee ... why would they publish & tweet stuff like that