News Feed
Sections




News Archive
Looking for more information on how to do PHP the right way? Check out PHP: The Right Way

Secunia.com:
TCExam PHP Code Execution and Cross-Site Scripting
May 01, 2007 @ 14:18:00

TCExam users will definitely want to pay attention to this latest advisory posted by Secunia detailing a PHP code execution and cross-site scripting issue that's been found:

rgod has discovered two vulnerabilities in TCExam, which can be exploited by malicious people to conduct cross-site scripting attacks or to compromise a vulnerable system.

The two issues is related to two different inpus not being handled properly - the mishandling of the SessionUserLang cookie and the _SERVER[SCRIPT_NAME] value. Neither of these are being sanitized.

This issue effects users of the TCExam 4.x series but a new version, 4.1.000, has already been released and made available for download.

0 comments voice your opinion now!
tcexam crosssitescripting xss execution sanitize tcexam crosssitescripting xss execution sanitize


blog comments powered by Disqus

Similar Posts

Zend Developer Zone: Avoiding XSS security attacks to sites that use HTML editors

DeveloperDrive.com: What Web Developers Need to Know About Cross-Site Scripting

Padraic Brady's Blog: Zend Framework Security Related Releases Now Available

Genius Engineering Blog: Genius Open Source Libraries (Sanitize HTML Input)

Padraic Brady's Blog: CodeIgniter 2.0.2: Cross-Site Scripting (XSS) Fixes And Recommendations


Community Events

Don't see your event here?
Let us know!


version voicesoftheelephpant opinion laravel performance symfony2 series extension interview php7 conference introduction podcast release example api community framework library application

All content copyright, 2015 PHPDeveloper.org :: info@phpdeveloper.org - Powered by the Solar PHP Framework