I don't think so, this is a vulneralability since the "scriptProtect" isn't applied to this variable

$FB_["rawFA"] = $attributes["fuseaction"];

simple example :

I have "scriptProtect" like this :

function validate($char)

{

if(preg_match('/[\'\"%|*(){}~`!@#$;\\/=+-_^]/',$char))

die("We have received an error request\n<br>");

}

Then the URL "http://xxx.xx/test.php?msg=blablabla"

test.php like the following script is vulner because validate function isn't applied.

<?php

$test=$_GET[msg];

echo "$test";

?>

We can solve the problem by validating GET request like this :

$test=validate($_GET[msg]);

I think that this case is clear enough.

Cheers

[ reply ]