Security Issue

There´s a possibility to include code into every page using AjaxSearch.
Due to an error in parsing every input (and especially quotes!) foreign code can be easily inserted and executed.
Just try something like this:

Enter into nearly every AjaxSearch. Move your mouse over the search-input-field afterwards.

Even modxcms.com may be XSS´ed this easy.

(When trying to fix: disable MagicQuotes in php.ini and try to use PHP´s htmlentities with parameter ENT_QOUTES and you´re done)

Cheers.

There´s a possibility to include code into every page using AjaxSearch.

Which version of AjaxSearch do yo use ?

I have done your test on the AjaxSearch demo site with version 1.7.1, 1.8.0 and 1.8.1

onmouseover=alert(212)

I have moved my mouse whithout any particular effect.

Quote from: coroico at Oct 09, 2008, 07:20 AM

There´s a possibility to include code into every page using AjaxSearch.

Which version of AjaxSearch do yo use ?

I have done your test on the AjaxSearch demo site with version 1.7.1, 1.8.0 and 1.8.1

onmouseover=alert(212)

I have moved my mouse whithout any particular effect.

I should have explicitly noted that it only occurs when using a separate site for results. (Edit: and no AJAX!)
My code from above breaks up the form-tag and adds the js-event mouseover to the tag.
Try it here: http://www.modx.wangba.fr/index.php?id=210 and you´ll succeed...

Another edit: I´ve been using some versions of AjaxSearch, atm I´m using 1.7.1. without Ajax and a separate site for search results...

For this XSS-attempt you need an AjaxSearch that shows up your search string in the input-tag after you sent this form...

Ok I undstand. But I don’t know which version of Ajaxsearch is used on the MODx CMS site. Probably a version <1.7.

The last time that we have to correct a security issue was in may 2008.
Here is the thread about that: http://modxcms.com/forums/index.php/topic,22843.0.html
This issue has been fixed with version 1.7.0.2

Excuse me for editing my post all the time.
So... all versions do have that security issue, as you can see it on your own site.
Go to
http://www.modx.wangba.fr/index.php?id=210
type in

and you´re done.

Ok so this occurs with non-ajax mode, when the results are displayed on the same page that the input form.

Have you already fixed this issue ?

Have a look at this function, located on line 1308 in search.class.inc.php (Version 1.8 )
This function might be the same in former releases.

Change it to as follows


Refer to: http://php.net/htmlentities

Combining this with MAGIC_QOUTES off might make this script a little safer...

This fix is not possible. The main reason is that when you use language with accent (like French or German), the use of htmlentities replace some characters by html entities. For instance you search "éducation" but with this correction mysql will receive "&Atilde;&copy;ducation" and doesn’t found any result because text is stored in database throught QuickEdit with Raw format. So in database stored as "éducation".

Any other idea ?

By the way...
What about that?


Edit: Content is stored with html entities, not raw (in my case). I´m using UTF-8. So the above mentioned works fine for me... But: is there a solution that works well for all people?

Please read this comment: http://us3.php.net/manual/en/function.htmlspecialchars.php#86240

This should be sufficient:

and from my understanding should just work (at least with ISO-8859-1 and UTF-8). I’m not even so sure the ENT_QUOTES param is necessary; the default may be enough but you’ll need to test.