Forum Discussion

sateesh999's avatar
sateesh999
Contributor
6 years ago

How to prevent cross-site-scripting and XSS?

How to prevent cross-site-scripting and XSS? We are getting messages from unknown users like the below: [ <img src=x onerror=prompt('xss by codejump');>  <img src=x onerror=prompt(/securitytestin...
    • luk's avatar
      luk
      Boss
      6 years ago

      sateesh999 do you have any idea how these messages are posted? TinyMCE does not allow any inline JS eventhandlers, they get stripped... try to post your above code, it doesn't work... but maybe if you get these messages posted via API, they are not sanitized...just a suspicion...

      • sateesh999's avatar
        sateesh999
        Contributor
        6 years ago

        luk ,


        Thanks for your response,

        No Idea how they are posted the scripts into our community.
        we thought that they are injected through the below steps

        -go to https://community.xxxxx.com and login

        -Then click Start a "New Discussion"

        -Now you can see the vulnerable area "Subject " put here XSS payload

        "><img src=x onerror=prompt(/abdullah/)>

        -And fill other random stuff and Post, And go All forum topics

        -XSS executed

        ===============
        And please let me know if they injected via API, Then how can we solve it?

         

        Regards,
        Sateesh.