BlueOwlCreative » Topic: Sanitize User Input

Sanitize User Input

TSV — Mon, 22 Sep 2014 18:22:32 +0000

Our security service, SiteLock, keeps telling us that we have a XSS vulnerability and we should edit our index.php to sanitize user input. There are over 30+ index.php with our website. They keep referencing: http://WebsiteURL.com?=1&s=Search…

Do you know which index.php file I need to “sanitize”? Is it within our theme or within the WP framework?

Reply To: Sanitize User Input

BlueOwl — Tue, 23 Sep 2014 09:40:42 +0000

Hi,

You sure this is the correct URL? I see some domain for sale message.

Reply To: Sanitize User Input

meteor — Sun, 26 Oct 2014 19:25:00 +0000

I have the same problem. Search page prints the search item without sanitizing the term. This results a reflective-XSS security problem. For more information:

https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OTG-INPVAL-001)

Can you submit updated version of the template?

Reply To: Sanitize User Input

BlueOwl — Mon, 27 Oct 2014 08:30:31 +0000

Hey,

This is default WP functionality and is not theme related.
And of course it does escape the special characters, did you actually try to pass some of the test strings shown in your examples?