Cross Site Scripting problem in showphoto.php

[rpertiet]

I'm running Photopost Pro 6.02 and just got flagged on PCI scanning for a Cross Site Scripting problem in showphoto.php.

Recommended solution:

When accepting user input ensure that you are HTML encoding potentially malicious characters if you ever display the data back to the client.

Ensure that parameters and user input are sanitized by doing the following:
Remove < input and replace with &lt;
Remove > input and replace with &gt;
Remove ' input and replace with &apos;
Remove " input and replace with &#x22;
Remove ) input and replace with &#x29;
Remove ( input and replace with &#x28;


Is there a fix for this?

Thanks

[Chuck S]

We store the characters your referring to like that. A simply look in the database shows this to be true.

We use a code sanitizing function.

[rpertiet]

Then why am I getting flagged??? Is this a false positive?

[Chuck S]

Not sure as I am not familiar with what your doing or what is flagging you but clearly we typecast the variables and any variables we use the php htmlspecialchars function on them.

PHP: htmlspecialchars - Manual

[Chuck S]

Take note also into the mix here is we change variables to store in the database and then when the description is viewed we convert the characters back so things view correct.

We also only allow the html tags noted here

Content visible to verified customers only.

You can not use embed object or script tags to try and embed malicious code we simply do not allow this.

[rpertiet]

Thanks for the response, I'll pass it onto McAfee.

[Chuck S]

McAfee is virus software for your home computer. They come out with some new internet scanner?

[rpertiet]

This is the old "Hacker Safe" daily PCI scanning. They re-branded it to the McAfee name about a year ago or so.

[Chuck S]

Well at any rate this is a false report issue by that product since we do correctly sanatize the variables.

[rpertiet]

This is still an error per the PCI scanner. Can you email or PM me so I can send you the problem link?

Thanks,

Randy

[Chuck S]

I have no control over your scanner thing and what results it shows. I am simply responding that we properly sanitize variables so there is no threat.