-- qbo <[EMAIL PROTECTED]> wrote
(on Tuesday, 29 July 2008, 10:05 AM -0700):
> Error message for Zend_Db_Statement_Exception for "Unclosed quotation mark
> after the character string" displays the user-submited data in a non-secure
> way, allwing cross-site scripting on error messages.
The fix for this is to do as we've recommended all along: do not enable
display_errors in production systems.
However, you're right -- the value should be escaped. I'll escalate the
issue.
> Exploit code needs to be free from single or double quotes (esaped in the
> erreor message) or spaces but it's still exploitable like this :
>
> param='<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
>
> which gives the following :
>
> ( ! ) Zend_Db_Statement_Exception: SQLSTATE[HY000]: General error: 20018
> Unclosed quotation mark after the character string
> '<SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>'. [20018] (severity
> 5) [(null)] in
> /usr/local/lib/php/ZendFramework-1.0.2/library/Zend/Db/Statement/Pdo.php on
> line 227</th></tr>
>
> call stack :
>
> Call Stack
>
> 1. Time Memory Function Location
> 1 0.0003 69852 {main}( ) ../main.php:0
> 2 0.0324 2102164 Zend_Controller_Front->dispatch( $request = ???,
> $response = ??? ) ../main.php:42
>
>
> I filed a bug in the tracking system. I'm available to confirm the issue
> with you or to disscuss the tehnical details.
>
>
> Regards,
>
> Quentin Berdugo
>
>
> --
> View this message in context:
> http://www.nabble.com/Cross-site-scripting-in-Zend_Db_Statement_Exception-handling-tp18716897p18716897.html
> Sent from the Zend Framework mailing list archive at Nabble.com.
>
--
Matthew Weier O'Phinney
Software Architect | [EMAIL PROTECTED]
Zend Framework | http://framework.zend.com/
