Search

[crankynurse]

Hi so my suggestion is to take the search option completely off. It may help some but in my opinion it is doing more harm then good at the moment. There are many vulns that can be found in this option and hard to trace them back. You can do anything from steal user logins to footholds into the DB with the right exploits via XSS through the search option. This is just a suggestion and the community should not freak out over this just hoping to get some feedback.

 

[BGlave]

Search is a very important feature to every forum. Because of this, it should stay. You may not use it so you don't see the use of it, while there are others who use it probably on a daily basis. As for the exploits, report it?

 

Dealing with this internally.

Haven't been able to reproduce any reported exploits in search (and all the known ones have been patched) but I've put in additional security for it anyway.

 

[crankynurse]

Search is a very important feature to every forum. Because of this, it should stay. You may not use it so you don't see the use of it, while there are others who use it probably on a daily basis. As for the exploits, report it?

Yes but what I'm getting at is there may come a time a exploit is successful and no one has any clue where to look because that could just be a foothold. But just a suggestion.

 

[Laptop65]

Hi so my suggestion is to take the search option completely off. It may help some but in my opinion it is doing more harm then good at the moment. There are many vulns that can be found in this option and hard to trace them back. You can do anything from steal user logins to footholds into the DB with the right exploits via XSS through the search option. This is just a suggestion and the community should not freak out over this just hoping to get some feedback.

Dealing with this internally.

Haven't been able to reproduce any reported exploits in search (and all the known ones have been patched) but I've put in additional security for it anyway.

What could you do through the search function? As in what exploits would be possible? I'm curious as I thought all you could do with it is just search stuff.

 

[crankynurse]

What could you do through the search function? As in what exploits would be possible? I'm curious as I thought all you could do with it is just search stuff.

You can do multiple XSS exploits anywhere from cookie credential stealing to footholds in the DB but as sythe said the ones that I reported to him have been patched or are to difficult to use but I'm constantly looking for them

 

Following Richard's post, denied. Thanks anyways.