Error message for Zend_Db_Statement_Exception for "Unclosed quotation mark
after the character string" displays the user-submited data in a non-secure
way, allwing cross-site scripting on error messages.
Exploit code needs to be free from single or double quotes (esaped in the
erreor message) or spaces but it's still exploitable like this :
param='<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
which gives the following :
( ! ) Zend_Db_Statement_Exception: SQLSTATE[HY000]: General error: 20018
Unclosed quotation mark after the character string
'<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>'. [20018] (severity
5) [(null)] in
/usr/local/lib/php/ZendFramework-1.0.2/library/Zend/Db/Statement/Pdo.php on
line 227</th></tr>
call stack :
Call Stack
1. Time Memory Function Location
1 0.0003 69852 {main}( ) ../main.php:0
2 0.0324 2102164 Zend_Controller_Front->dispatch( $request = ???,
$response = ??? ) ../main.php:42
I filed a bug in the tracking system. I'm available to confirm the issue
with you or to disscuss the tehnical details.
Regards,
Quentin Berdugo
--
View this message in context:
http://www.nabble.com/Cross-site-scripting-in-Zend_Db_Statement_Exception-handling-tp18716897p18716897.html
Sent from the Zend Framework mailing list archive at Nabble.com.
