splooge
Wed 22nd May '02, 4:06pm
I sent a PM to someone, but I am mainly looking for a response from someone asap and Kier may just be too busy ;p
It seems that the filename upload in the attachment option is parsed for HTML. Someone did some messing around and uploaded (I think) a long file name which executed some little quick java script that opened up a new window and posted a new post titled "I am a monkey." rofl. So whoever read that thread (even though html is off) that script got executed, and I ended up with 50 new threads titled "I am a monkey." While I think it was pretty cool, hehe, I think I need to make sure this is or isn't really a security issue or just the way I've got something setup?
Here's a link to some quick discussion on it:
http://www.pwned.com/showthread.php?s=&threadid=5170
login abc:123
In the meantime I disabled file uploads by removing all allowed upload extensions (Is this the best way?)
My main thing is he's claiming that by doing this he can grab other peoples session IDs and log on as them or something. Spooky! (Although I believe the session ID is only one of like 4 identifiers proving who you are, one of the others being IP address?)
Thanks. ;p These guys are like ninja compared to me.
It seems that the filename upload in the attachment option is parsed for HTML. Someone did some messing around and uploaded (I think) a long file name which executed some little quick java script that opened up a new window and posted a new post titled "I am a monkey." rofl. So whoever read that thread (even though html is off) that script got executed, and I ended up with 50 new threads titled "I am a monkey." While I think it was pretty cool, hehe, I think I need to make sure this is or isn't really a security issue or just the way I've got something setup?
Here's a link to some quick discussion on it:
http://www.pwned.com/showthread.php?s=&threadid=5170
login abc:123
In the meantime I disabled file uploads by removing all allowed upload extensions (Is this the best way?)
My main thing is he's claiming that by doing this he can grab other peoples session IDs and log on as them or something. Spooky! (Although I believe the session ID is only one of like 4 identifiers proving who you are, one of the others being IP address?)
Thanks. ;p These guys are like ninja compared to me.