don't delete
Hi Norman
Thank you for the input.
I don't think your post should be deleted; this is a serious flaw that needs to be addressed.
We now use the ScanAlert service, below is their description of the flaw and possible consequences:
"The cross-site scripting attack is one of the most common, yet overlooked, security problems facing web developers today. A web site is vulnerable if it displays user-submitted content without checking for malicious script tags.
The target of cross-site scripting attacks is not the server itself, but the user files on the server, such as forms and other dynamic content. All a malicious attacker needs to do is find a page that does not properly sanitize user input, but returns the scripting code verbatim to the browser of a visitor to that website. It is important to note that websites that use SSL are just as vulnerable as websites that do not encrypt browser sessions.
The damage caused by such an attack can range from stealing session and cookie data from your customers to loading a virus payload onto their computer via browser."
Given that we are all running ecommerce operations this could be a serious issue. Also we would not necessarily be aware of it until it was too late.
This does need a fix for all versions of Actinic, not just current versions.
Given that Actinic is the leader in ecommerce solutions it is not unreasonable to suppose that someone has already tried this exploit.
This is not the first time we have come across serious security flaws in the product or a lacklustre response.
Hi Norman
Thank you for the input.
I don't think your post should be deleted; this is a serious flaw that needs to be addressed.
We now use the ScanAlert service, below is their description of the flaw and possible consequences:
"The cross-site scripting attack is one of the most common, yet overlooked, security problems facing web developers today. A web site is vulnerable if it displays user-submitted content without checking for malicious script tags.
The target of cross-site scripting attacks is not the server itself, but the user files on the server, such as forms and other dynamic content. All a malicious attacker needs to do is find a page that does not properly sanitize user input, but returns the scripting code verbatim to the browser of a visitor to that website. It is important to note that websites that use SSL are just as vulnerable as websites that do not encrypt browser sessions.
The damage caused by such an attack can range from stealing session and cookie data from your customers to loading a virus payload onto their computer via browser."
Given that we are all running ecommerce operations this could be a serious issue. Also we would not necessarily be aware of it until it was too late.
This does need a fix for all versions of Actinic, not just current versions.
Given that Actinic is the leader in ecommerce solutions it is not unreasonable to suppose that someone has already tried this exploit.
This is not the first time we have come across serious security flaws in the product or a lacklustre response.
Comment