Daniweb XSS injections

[cwarn23]

I have discovered that in emails any html code in the topic name appears as styled html in the email. I would suggest using htmlentities on the subject in the email updates. Just thought I would let you know of this security risk.

[Dani]

Please send me an example??

[cwarn23]

Well subscribe to the thread at the following link then make a reply to that thread then you will see the <div> in the title will not appear in the email. It will actually execute the div code making a div box.
http://www.daniweb.com/forums/thread260244.html

[Dani]

Can you take a screenshot for me?

[cwarn23]

Attached to this post is a screenshot of the email and the <div> in the topic title doesn't appear in the email link title and instead appears as a actual <div> field.

[Dani]

Thanks for the catch! Fixed. :)

[Dani]

Gah! I spoke too soon ... :(

[Dani]

Can you let me know if this has been fixed?

[cwarn23]

I have created a thread at the below link and if you reply to it I will see if it injects the code into the email.
http://www.daniweb.com/forums/post1136135.html#post1136135

[cwarn23]

I just got a reply from thread260244 and the only problem which I don't think can be solved is that although it is fine in webmail, in email clients, the html entities show in the title of the email. So yea looks like it is solved. If you subscribe to my other thread I can reply to it and ya can see what has been going on.

[Dani]

I'd rather it be double escaped than unescaped and vulnerable.

[cwarn23]

Now you mention it that is a great reason for the title to be escaped. All is now good so I shall mark this topic solved.

I'd rather it be double escaped than unescaped and vulnerable.