From 9acfa55fcd28d56b80a5c83714de03d14fbf098f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Murat=20Y=C4=B1lmazlar?= Date: Sat, 1 Oct 2016 18:30:35 +0300 Subject: [PATCH] Created CONTRIBUTING.md file Try to explain XSS vulnerability on script. --- Blog/CONTRIBUTING.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 Blog/CONTRIBUTING.md diff --git a/Blog/CONTRIBUTING.md b/Blog/CONTRIBUTING.md new file mode 100644 index 0000000..71d2f61 --- /dev/null +++ b/Blog/CONTRIBUTING.md @@ -0,0 +1,16 @@ +Hi, + +I found a XSS vulnerability on your script's "register.php" file. In this file you have 3 inputs with no protection against XSS attacks. + +These are: fullname, email and username. + +You just POST the data like _POST['username']; + +You should use isset($_POST) it would be more secure. + +You can find additional information about this attack and how to secure your code against this attack you can use google. + + +Have a nice day! + +:)