Re: [WebDNA] WebDNA code displaying on page

This WebDNA talk-list message is from

2012

It keeps the original formatting. numero = 110001
interpreted = N
texte = --e89a8ff1c85cb1967f04d0ad1e24Content-Type: text/plain; charset=ISO-8859-1You include this at the top of all pages:[/!][!]Prevent tag hacking[/!][!][/!][!]--- START: to plug up the security hole of when URL hacker passes awebdna context name as a formvar---[/!][!][/!][formvariables name=!][redirect /][/formvariables][!][/!][formvariables name=addfields][redirect /][/formvariables][!][/!][formvariables name=addlineitem][redirect /][/formvariables][!][/!][formvariables name=append][redirect /][/formvariables][!][/!][formvariables name=appendfile][redirect /][/formvariables][!][/!][formvariables name=applescript][redirect /][/formvariables][!][/!][formvariables name=arrayget][redirect /][/formvariables][!][/!][formvariables name=arrayset][redirect /][/formvariables][!][/!][formvariables name=authenticate][redirect /][/formvariables][!][/!][formvariables name=boldwords][redirect /][/formvariables][!][/!][formvariables name=browsername][redirect /][/formvariables][!][/!][formvariables name=calcfilecrc32][redirect /][/formvariables][!][/!][formvariables name=capitalize][redirect /][/formvariables][!][/!][formvariables name=case][redirect /][/formvariables][!][/!][formvariables name=clearlineitems][redirect /][/formvariables][!][/!][formvariables name=closedatabase][redirect /][/formvariables][!][/!][formvariables name=command][redirect /][/formvariables][!][/!][formvariables name=commitdatabase][redirect /][/formvariables][!][/!][formvariables name=convertchars][redirect /][/formvariables][!][/!][formvariables name=convertwords][redirect /][/formvariables][!][/!][formvariables name=copyfile][redirect /][/formvariables][!][/!][formvariables name=copyfolder][redirect /][/formvariables][!][/!][formvariables name=countchars][redirect /][/formvariables][!][/!][formvariables name=countwords][redirect /][/formvariables][!][/!][formvariables name=createfolder][redirect /][/formvariables][!][/!][formvariables name=date][redirect /][/formvariables][!][/!][formvariables name=ddeconnect][redirect /][/formvariables][!][/!][formvariables name=ddesend][redirect /][/formvariables][!][/!][formvariables name=decrypt][redirect /][/formvariables][!][/!][formvariables name=delete][redirect /][/formvariables][!][/!][formvariables name=deletefile][redirect /][/formvariables][!][/!][formvariables name=deletefolder][redirect /][/formvariables][!][/!][formvariables name=dos][redirect /][/formvariables][!][/!][formvariables name=elapsedtime][redirect /][/formvariables][!][/!][formvariables name=else][redirect /][/formvariables][!][/!][formvariables name=encrypt][redirect /][/formvariables][!][/!][formvariables name=exclusivelock][redirect /][/formvariables][!][/!][formvariables name=filecompare][redirect /][/formvariables][!][/!][formvariables name=fileinfo][redirect /][/formvariables][!][/!][formvariables name=findstring][redirect /][/formvariables][!][/!][formvariables name=flushcache][redirect /][/formvariables][!][/!][formvariables name=flushdatabases][redirect /][/formvariables][!][/!][formvariables name=format][redirect /][/formvariables][!][/!][formvariables name=format][redirect /][/formvariables][!][/!][formvariables name=formvariables][redirect /][/formvariables][!][/!][formvariables name=founditems][redirect /][/formvariables][!][/!][formvariables name=freememory][redirect /][/formvariables][!][/!][formvariables name=function][redirect /][/formvariables][!][/!][formvariables name=getchars][redirect /][/formvariables][!][/!][formvariables name=getcookie][redirect /][/formvariables][!][/!][formvariables name=getmimeheader][redirect /][/formvariables][!][/!][formvariables name=grep][redirect /][/formvariables][!][/!][formvariables name=hideif][redirect /][/formvariables][!][/!][formvariables name=html1][redirect /][/formvariables][!][/!][formvariables name=html2][redirect /][/formvariables][!][/!][formvariables name=html3][redirect /][/formvariables][!][/!][formvariables name=httpmethod][redirect /][/formvariables][!][/!][formvariables name=if][redirect /][/formvariables][!][/!][formvariables name=include][redirect /][/formvariables][!][/!][formvariables name=input][redirect /][/formvariables][!][/!][formvariables name=interpret][redirect /][/formvariables][!][/!][formvariables name=ipaddress][redirect /][/formvariables][!][/!][formvariables name=issecureclient][redirect /][/formvariables][!][/!][formvariables name=lastautonumner][redirect /][/formvariables][!][/!][formvariables name=lastrandom][redirect /][/formvariables][!][/!][formvariables name=lineitems][redirect /][/formvariables][!][/!][formvariables name=listchars][redirect /][/formvariables][!][/!][formvariables name=listcookies][redirect /][/formvariables][!][/!][formvariables name=listdatabases][redirect /][/formvariables][!][/!][formvariables name=listfields][redirect /][/formvariables][!][/!][formvariables name=listfiles][redirect /][/formvariables][!][/!][formvariables name=listmimeheaders][redirect /][/formvariables][!][/!][formvariables name=listpath][redirect /][/formvariables][!][/!][formvariables name=listvariables][redirect /][/formvariables][!][/!][formvariables name=listwords][redirect /][/formvariables][!][/!][formvariables name=lookup][redirect /][/formvariables][!][/!][formvariables name=lookup][redirect /][/formvariables][!][/!][formvariables name=loop][redirect /][/formvariables][!][/!][formvariables name=lowercase][redirect /][/formvariables][!][/!][formvariables name=math][redirect /][/formvariables][!][/!][formvariables name=middle][redirect /][/formvariables][!][/!][formvariables name=movefile][redirect /][/formvariables][!][/!][formvariables name=object][redirect /][/formvariables][!][/!][formvariables name=orderfile][redirect /][/formvariables][!][/!][formvariables name=password][redirect /][/formvariables][!][/!][formvariables name=platform][redirect /][/formvariables][!][/!][formvariables name=product][redirect /][/formvariables][!][/!][formvariables name=protect][redirect /][/formvariables][!][/!][formvariables name=purchase][redirect /][/formvariables][!][/!][formvariables name=random][redirect /][/formvariables][!][/!][formvariables name=raw][redirect /][/formvariables][!][/!][formvariables name=redirect][redirect /][/formvariables][!][/!][formvariables name=referrer][redirect /][/formvariables][!][/!][formvariables name=removehtml][redirect /][/formvariables][!][/!][formvariables name=removelineitem][redirect /][/formvariables][!][/!][formvariables name=replace][redirect /][/formvariables][!][/!][formvariables name=replacefounditems][redirect /][/formvariables][!][/!][formvariables name=return][redirect /][/formvariables][!][/!][formvariables name=returnraw][redirect /][/formvariables][!][/!][formvariables name=scope][redirect /][/formvariables][!][/!][formvariables name=search][redirect /][/formvariables][!][/!][formvariables name=sendmail][redirect /][/formvariables][!][/!][formvariables name=setcookie][redirect /][/formvariables][!][/!][formvariables name=setheader][redirect /][/formvariables][!][/!][formvariables name=setlineitem][redirect /][/formvariables][!][/!][formvariables name=setmimeheader][redirect /][/formvariables][!][/!][formvariables name=shell][redirect /][/formvariables][!][/!][formvariables name=showif][redirect /][/formvariables][!][/!][formvariables name=shownext][redirect /][/formvariables][!][/!][formvariables name=spawn][redirect /][/formvariables][!][/!][formvariables name=sql][redirect /][/formvariables][!][/!][formvariables name=sql][redirect /][/formvariables][!][/!][formvariables name=sqlconnect][redirect /][/formvariables][!][/!][formvariables name=sqldisconnect][redirect /][/formvariables][!][/!][formvariables name=sqlexecute][redirect /][/formvariables][!][/!][formvariables name=sqlinfo][redirect /][/formvariables][!][/!][formvariables name=sqlrelease][redirect /][/formvariables][!][/!][formvariables name=sqlresult][redirect /][/formvariables][!][/!][formvariables name=switch][redirect /][/formvariables][!][/!][formvariables name=table][redirect /][/formvariables][!][/!][formvariables name=tcpconnect][redirect /][/formvariables][!][/!][formvariables name=tcpsend][redirect /][/formvariables][!][/!][formvariables name=text][redirect /][/formvariables][!][/!][formvariables name=then][redirect /][/formvariables][!][/!][formvariables name=thisurl][redirect /][/formvariables][!][/!][formvariables name=time][redirect /][/formvariables][!][/!][formvariables name=unurl][redirect /][/formvariables][!][/!][formvariables name=uppercase][redirect /][/formvariables][!][/!][formvariables name=url][redirect /][/formvariables][!][/!][formvariables name=username][redirect /][/formvariables][!][/!][formvariables name=validcard][redirect /][/formvariables][!][/!][formvariables name=version][redirect /][/formvariables][!][/!][formvariables name=version][redirect /][/formvariables][!][/!][formvariables name=waitforfile][redirect /][/formvariables][!][/!][formvariables name=writefile][redirect /][/formvariables][!][/!][formvariables name=xmlnode][redirect /][/formvariables][!][/!][formvariables name=xmlnodes][redirect /][/formvariables][!][/!][formvariables name=xmlnodesattributes][redirect /][/formvariables][!][/!][formvariables name=xmlparse][redirect /][/formvariables][!][/!][formvariables name=xsl][redirect /][/formvariables][!][/!][formvariables name=xslt][redirect /][/formvariables][!][/!][!]--- END: to plug up the security hole of when URL hacker passes awebdna context name as a formvar---[/!]Daniel Meola301-486-0901daniel@knifecenter.comOn Wed, Dec 12, 2012 at 2:44 PM, Terry Wilson wrote:> This exploit was discovered a few years back, but I thought it was fixed,> or a fix was announced or something. I forget.>> Terry>>>> Hi,>>>> I am running V6.2 on CentOS 5.8 and have found instances where WebDNA>> code displays on a page if certain WebDNA tags are in the URL.>>>> I thought it was something I was doing but this appears to happen on the>> www.webdna.us site as well.>>>> http://www.webdna.us/page.dna?**text=>> takes you to a page that shows only webdna code>>>> http://www.webdna.us/page.dna?**numero=56&text=>> adds a line of text above the navigation row in the red background (need>> to mouse over to see it - text is same color as red background)>>>>>> I first experienced this with != and fixed it by putting a RewriteRule>> in an .htaccess file in the site's root folder>>>> Today I tried a few other tags and found others. I haven't checked all>> the tags just a handful.>>>> text=>> math=>> format=>>>> Anyone else experience this, have a fix or suggestion?>>>> Thanks,>> Steve>>>>>> ------------------------------**--------------------------->> This message is sent to you because you are subscribed to>> the mailing list .>> To unsubscribe, E-mail to: >> archives: http://mail.webdna.us/list/**talk@webdna.us>> Bug Reporting: support@webdna.us>>>>> --> Terry Wilson | terry@terryfic.com | http://terryfic.com> http://WhosComing.com - a simplified, affordable online reservation system> iStockPhoto portfolio - http://www.istockphoto.com/**> Terryfic3D?refnum=Terryfic3D> ------------------------------**------------------------------**> --------------> Attitude is the only difference between ordeal and adventure.>> ------------------------------**---------------------------> This message is sent to you because you are subscribed to> the mailing list .> To unsubscribe, E-mail to: > archives: http://mail.webdna.us/list/**talk@webdna.us> Bug Reporting: support@webdna.us>--e89a8ff1c85cb1967f04d0ad1e24Content-Type: text/html; charset=ISO-8859-1Content-Transfer-Encoding: quoted-printableYou include this at the top of all pages:

[/!][!]Prevent tag hacking[/!][!]

[/!][!]--- START: to plug= up the security hole of when URL hacker passes a webdna context name as a =formvar---[/!][!]

[/!][formvariables name=3D!][redirect /][/formvariables][!]

=[/!][formvariables name=3Daddfields][redirect /][/formvariables][!]

[/!][formvariables name=3Daddlineitem][redirect /][/formvariables][!]

[/!][formvariables name=3Dappend][redirect /][/formvariables][!]

[/!][formvariables name=3Dappendfile][redirect /][/formvariables][!]

[/!][formvariables name=3Dapplescript][redirect /][/formvariables]=[!]

[/!][formvariables name=3Darrayget][redirect /][/formvariables][!]

[/!][formvariables name=3Darrayset][redirect /][/formvariables][!]

[/!][formvariables name=3Dauthenticate][redirect /][/formvariables=][!]

[/!][formvariables name=3Dboldwords][redirect /][/formvariables][!]

[/!][formvariables name=3Dbrowsername][redirect /][/formvariables][=!]

[/!][formvariables name=3Dcalcfilecrc32][redirect /][/formvari=ables][!]

[/!][formvariables name=3Dcapitalize][redirect /][/formvariables][!]

[/!][formvariables name=3Dcase][redirect /][/formvariables][!]

[/!][formvariables name=3Dclearlineitems][redirect /][/formvariables=][!]

[/!][formvariables name=3Dclosedatabase][redirect /][/formvariables][!=]

[/!][formvariables name=3Dcommand][redirect /][/formvariables][=!]

[/!][formvariables name=3Dcommitdatabase][redirect /][/formvar=iables][!]

[/!][formvariables name=3Dconvertchars][redirect /][/formvariables][!]=

[/!][formvariables name=3Dconvertwords][redirect /][/formvariabl=es][!]

[/!][formvariables name=3Dcopyfile][redirect /][/formvaria=bles][!]

[/!][formvariables name=3Dcopyfolder][redirect /][/formvariables][!]

[/!][formvariables name=3Dcountchars][redirect /][/formvariables][=!]

[/!][formvariables name=3Dcountwords][redirect /][/formvariabl=es][!]

[/!][formvariables name=3Dcreatefolder][redirect /][/formvariables][!]=

[/!][formvariables name=3Ddate][redirect /][/formvariables][!]

[/!][formvariables name=3Dddeconnect][redirect /][/formvariables][=!]

[/!][formvariables name=3Dddesend][redirect /][/formvariables][!]

[/!][formvariables name=3Ddecrypt][redirect /][/formvariables][!]

[/!][formvariables name=3Ddelete][redirect /][/formvariables][!]

[/!][formvariables name=3Ddeletefile][redirect /][/formvariables][!]

[/!][formvariables name=3Ddeletefolder][redirect /][/formvariables=][!]

[/!][formvariables name=3Ddos][redirect /][/formvariables][!=]

[/!][formvariables name=3Delapsedtime][redirect /][/formvariables][!]<=/div>

[/!][formvariables name=3Delse][redirect /][/formvariables][!]

[/!][formvariables name=3Dencrypt][redirect /][/formvariables][!]

[/!][formvariables name=3Dexclusivelock][redirect /][/formvariables][!=]

[/!][formvariables name=3Dfilecompare][redirect /][/formvariabl=es][!]

[/!][formvariables name=3Dfileinfo][redirect /][/formvaria=bles][!]

[/!][formvariables name=3Dfindstring][redirect /][/formvariables][!]

[/!][formvariables name=3Dflushcache][redirect /][/formvariables][=!]

[/!][formvariables name=3Dflushdatabases][redirect /][/formvar=iables][!]

[/!][formvariables name=3Dformat][redirect /][/formvariables][!]

[/!][formvariables name=3Dformvariables][redirect /][/formvariables][!=]

[/!][formvariables name=3Dfounditems][redirect /][/formvariables][!]

[/!][formvariables name=3Dfreememory][redirect /][/formvariables][=!]

[/!][formvariables name=3Dfunction][redirect /][/formvariables=][!]

[/!][formvariables name=3Dgetchars][redirect /][/formvariables][!]

[/!][formvariables name=3Dgetcookie][redirect /][/formvariables][!]<=/div>

[/!][formvariables name=3Dgetmimeheader][redirect /][/formvariabl=es][!]

[/!][formvariables name=3Dgrep][redirect /][/formvariables][!]

[/!][formvariables name=3Dhideif][redirect /][/formvariables][!]

[/!][formvariables name=3Dhtml1][redirect /][/formvariables][!]

[/!][formvariables name=3Dhtml2][redirect /][/formvariables][!]

[=/!][formvariables name=3Dhtml3][redirect /][/formvariables][!]

[/=!][formvariables name=3Dhttpmethod][redirect /][/formvariables][!]

[/!][formvariables name=3Dif][redirect /][/formvariables][!]

[/!]=[formvariables name=3Dinclude][redirect /][/formvariables][!]

[/!=][formvariables name=3Dinput][redirect /][/formvariables][!]

[/!]=[formvariables name=3Dinterpret][redirect /][/formvariables][!]

[/!][formvariables name=3Dipaddress][redirect /][/formvariables][!]

[/!][formvariables name=3Dissecureclient][redirect /][/formvariable=s][!]

[/!][formvariables name=3Dlastautonumner][redirect /][/form=variables][!]

[/!][formvariables name=3Dlastrandom][redirect /][/formvariables][!]

[/!][formvariables name=3Dlineitems][redirect /][/formvariables][!=]

[/!][formvariables name=3Dlistchars][redirect /][/formvariables=][!]

[/!][formvariables name=3Dlistcookies][redirect /][/formvariables][!]<=/div>

[/!][formvariables name=3Dlistdatabases][redirect /][/formvariabl=es][!]

[/!][formvariables name=3Dlistfields][redirect /][/formvar=iables][!]

[/!][formvariables name=3Dlistfiles][redirect /][/formvariables][!]

[/!][formvariables name=3Dlistmimeheaders][redirect /][/formvariabl=es][!]

[/!][formvariables name=3Dlistpath][redirect /][/formvaria=bles][!]

[/!][formvariables name=3Dlistvariables][redirect /][/formvariables][!=]

[/!][formvariables name=3Dlistwords][redirect /][/formvariables=][!]

[/!][formvariables name=3Dlookup][redirect /][/formvariables=][!]

[/!][formvariables name=3Dlookup][redirect /][/formvariables][!]

[/!][formvariables name=3Dloop][redirect /][/formvariables][!]

[/!][formvariables name=3Dlowercase][redirect /][/formvariables][!]

[/!][formvariables name=3Dmath][redirect /][/formvariables][!]

[/=!][formvariables name=3Dmiddle][redirect /][/formvariables][!]

[/=!][formvariables name=3Dmovefile][redirect /][/formvariables][!]

=[/!][formvariables name=3Dobject][redirect /][/formvariables][!]

[/!][formvariables name=3Dorderfile][redirect /][/formvariables][!]

[/!][formvariables name=3Dpassword][redirect /][/formvariables][!]<=/div>

[/!][formvariables name=3Dplatform][redirect /][/formvariables][!=]

[/!][formvariables name=3Dproduct][redirect /][/formvariables][!]

[/!][formvariables name=3Dprotect][redirect /][/formvariables][!]

[/!][formvariables name=3Dpurchase][redirect /][/formvariables][!]

[/!][formvariables name=3Drandom][redirect /][/formvariables][!]

[/!][formvariables name=3Draw][redirect /][/formvariables][!]

[/!][formvariables name=3Dredirect][redirect /][/formvariables][!]

<=div>[/!][formvariables name=3Dreferrer][redirect /][/formvariables][!]

[/!][formvariables name=3Dremovehtml][redirect /][/formvariables][!]

[/!][formvariables name=3Dremovelineitem][redirect /][/formvariables]=[!]

[/!][formvariables name=3Dreplace][redirect /][/formvariables][!]

[/!][formvariables name=3Dreplacefounditems][redirect /][/formvariabl=es][!]

[/!][formvariables name=3Dreturn][redirect /][/formvariabl=es][!]

[/!][formvariables name=3Dreturnraw][redirect /][/formvariables][!]

[/!][formvariables name=3Dscope][redirect /][/formvariables][!]

[/!][formvariables name=3Dsearch][redirect /][/formvariables][!]

[/!][formvariables name=3Dsendmail][redirect /][/formvariables][!]

[/!][formvariables name=3Dsetcookie][redirect /][/formvariables][!]<=/div>

[/!][formvariables name=3Dsetheader][redirect /][/formvariables][=!]

[/!][formvariables name=3Dsetlineitem][redirect /][/formvariables][!]<=/div>

[/!][formvariables name=3Dsetmimeheader][redirect /][/formvariabl=es][!]

[/!][formvariables name=3Dshell][redirect /][/formvariable=s][!]

[/!][formvariables name=3Dshowif][redirect /][/formvariables][!]

[/!][formvariables name=3Dshownext][redirect /][/formvariables][!]

[/!][formvariables name=3Dspawn][redirect /][/formvariables][!]

[/!][formvariables name=3Dsql][redirect /][/formvariables][!]

[/!=][formvariables name=3Dsql][redirect /][/formvariables][!]

[/!][f=ormvariables name=3Dsqlconnect][redirect /][/formvariables][!]

[/=!][formvariables name=3Dsqldisconnect][redirect /][/formvariables][!]

[/!][formvariables name=3Dsqlexecute][redirect /][/formvariables][!]

[/!][formvariables name=3Dsqlinfo][redirect /][/formvariables][!]<=/div>

[/!][formvariables name=3Dsqlrelease][redirect /][/formvariables]=[!]

[/!][formvariables name=3Dsqlresult][redirect /][/formvariables][!]

[/!][formvariables name=3Dswitch][redirect /][/formvariables][!]

[/!][formvariables name=3Dtable][redirect /][/formvariables][!]

[/!][formvariables name=3Dtcpconnect][redirect /][/formvariables][!]

[/!][formvariables name=3Dtcpsend][redirect /][/formvariables][!]<=/div>

[/!][formvariables name=3Dtext][redirect /][/formvariables][!]

[/!][formvariables name=3Dthen][redirect /][/formvariables][!]

[/!][formvariables name=3Dthisurl][redirect /][/formvariables][!]

<=div>[/!][formvariables name=3Dtime][redirect /][/formvariables][!]

[/!][formvariables name=3Dunurl][redirect /][/formvariables][!]

[=/!][formvariables name=3Duppercase][redirect /][/formvariables][!]

[/!][formvariables name=3Durl][redirect /][/formvariables][!]

[=/!][formvariables name=3Dusername][redirect /][/formvariables][!]

[/!][formvariables name=3Dvalidcard][redirect /][/formvariables][!]

[/!][formvariables name=3Dversion][redirect /][/formvariables][!]

[/!][formvariables name=3Dversion][redirect /][/formvariables][!]<=/div>

[/!][formvariables name=3Dwaitforfile][redirect /][/formvariables][!]<=/div>

[/!][formvariables name=3Dwritefile][redirect /][/formvariables][=!]

[/!][formvariables name=3Dxmlnode][redirect /][/formvariables]=[!]

[/!][formvariables name=3Dxmlnodes][redirect /][/formvariables][!]

[/!][formvariables name=3Dxmlnodesattributes][redirect /][/formvaria=bles][!]

[/!][formvariables name=3Dxmlparse][redirect /][/formvar=iables][!]

[/!][formvariables name=3Dxsl][redirect /][/formvariables][!]

[/!][formvariables name=3Dxslt][redirect /][/formvariables][!]

=[/!][!]--- END: to plug up the security hole of when URL hacker passes a we=bdna context name as a formvar---[/!]

Daniel Meola

301-486-0901

daniel@knifecenter.com

On Wed, Dec 12, 2012 at 2:44 PM, Terry W=ilson <terry@terryfic.com> wrote:

This exploit was discovered a few years back, but I thought it was fixed, o=r a fix was announced or something. I forget.

Terry

Hi,

I am running V6.2 on CentOS 5.8 and have found instances where WebDNA code =displays on a page if certain WebDNA tags are in the URL.

I thought it was something I was doing but this appears to happen on the www.webdna.us site as =well.

http://=www.webdna.us/page.dna?text=3D
takes you to a page that shows only webdna code

http://www.webdna.us/page.dna?numero=3D56&text=3Dadds a line of text above the navigation row in the red background (need to= mouse over to see it - text is same color as red background)

I first experienced this with =A0 !=3D =A0and fixed it by putting a Rewrite=Rule in an .htaccess file in the site's root folder

Today I tried a few other tags and found others. I haven't checked all =the tags just a handful.

text=3D
math=3D
format=3D

Anyone else experience this, have a fix or suggestion?

Thanks,
Steve

---------------------------------------------------------
This message is sent to you because you are subscribed to
the mailing list <ta=lk@webdna.us>.
To unsubscribe, E-mail to: <talk-leave@webdna.us>
archives: http://mail.webdna.us/list/talk@webdna.us
Bug Reporting: suppo=rt@webdna.us

--
Terry Wilson | terr=y@terryfic.com | http=://terryfic.com
http://WhosComing.com - a simplified, affordable online reservation system
iStockPhoto portfolio - http://www.istockphoto.com/Terr=yfic3D?refnum=3DTerryfic3D
-------------------------------------------------------------=-------------
Attitude is the only difference between ordeal and adventure.=

---------------------------------------------------------
This message is sent to you because you are subscribed to
the mailing list <ta=lk@webdna.us>.
To unsubscribe, E-mail to: <talk-leave@webdna.us>
archives: http://mail.webdna.us/list/talk@webdna.us
Bug Reporting: suppo=rt@webdna.us

--e89a8ff1c85cb1967f04d0ad1e24-- Associated Messages, from the most recent to the oldest:

Re: [WebDNA] WebDNA code displaying on page (WebDNA Solutions 2012)
Re: [WebDNA] WebDNA code displaying on page (Tom Duke 2012)
Re: [WebDNA] WebDNA code displaying on page (Donovan Brooke 2012)
Re: [WebDNA] WebDNA code displaying on page (Donovan Brooke 2012)
Re: [WebDNA] WebDNA code displaying on page (Govinda 2012)
Re: [WebDNA] WebDNA code displaying on page (Michael Davis 2012)
Re: [WebDNA] WebDNA code displaying on page (Steve Raslevich 2012)
Re: [WebDNA] WebDNA code displaying on page (Michael Davis 2012)
Re: [WebDNA] WebDNA code displaying on page (Steve Raslevich 2012)
Re: [WebDNA] WebDNA code displaying on page (Daniel Meola 2012)
Re: [WebDNA] WebDNA code displaying on page (Brian Fries 2012)
Re: [WebDNA] WebDNA code displaying on page (Steve Raslevich 2012)
Re: [WebDNA] WebDNA code displaying on page (Steve Raslevich 2012)
Re: [WebDNA] WebDNA code displaying on page (WebDNA Solutions 2012)
Re: [WebDNA] WebDNA code displaying on page (Daniel Meola 2012)
Re: [WebDNA] WebDNA code displaying on page (christophe.billiottet@webdna.us 2012)

--e89a8ff1c85cb1967f04d0ad1e24Content-Type: text/plain; charset=ISO-8859-1You include this at the top of all pages:[/!][!]Prevent tag hacking[/!][!][/!][!]--- START: to plug up the security hole of when URL hacker passes awebdna context name as a formvar---[/!][!][/!][formvariables name=!][redirect /][/formvariables][!][/!][formvariables name=addfields][redirect /][/formvariables][!][/!][formvariables name=addlineitem][redirect /][/formvariables][!][/!][formvariables name=append][redirect /][/formvariables][!][/!][formvariables name=appendfile][redirect /][/formvariables][!][/!][formvariables name=applescript][redirect /][/formvariables][!][/!][formvariables name=arrayget][redirect /][/formvariables][!][/!][formvariables name=arrayset][redirect /][/formvariables][!][/!][formvariables name=authenticate][redirect /][/formvariables][!][/!][formvariables name=boldwords][redirect /][/formvariables][!][/!][formvariables name=browsername][redirect /][/formvariables][!][/!][formvariables name=calcfilecrc32][redirect /][/formvariables][!][/!][formvariables name=capitalize][redirect /][/formvariables][!][/!][formvariables name=case][redirect /][/formvariables][!][/!][formvariables name=clearlineitems][redirect /][/formvariables][!][/!][formvariables name=closedatabase][redirect /][/formvariables][!][/!][formvariables name=command][redirect /][/formvariables][!][/!][formvariables name=commitdatabase][redirect /][/formvariables][!][/!][formvariables name=convertchars][redirect /][/formvariables][!][/!][formvariables name=convertwords][redirect /][/formvariables][!][/!][formvariables name=copyfile][redirect /][/formvariables][!][/!][formvariables name=copyfolder][redirect /][/formvariables][!][/!][formvariables name=countchars][redirect /][/formvariables][!][/!][formvariables name=countwords][redirect /][/formvariables][!][/!][formvariables name=createfolder][redirect /][/formvariables][!][/!][formvariables name=date][redirect /][/formvariables][!][/!][formvariables name=ddeconnect][redirect /][/formvariables][!][/!][formvariables name=ddesend][redirect /][/formvariables][!][/!][formvariables name=decrypt][redirect /][/formvariables][!][/!][formvariables name=delete][redirect /][/formvariables][!][/!][formvariables name=deletefile][redirect /][/formvariables][!][/!][formvariables name=deletefolder][redirect /][/formvariables][!][/!][formvariables name=dos][redirect /][/formvariables][!][/!][formvariables name=elapsedtime][redirect /][/formvariables][!][/!][formvariables name=else][redirect /][/formvariables][!][/!][formvariables name=encrypt][redirect /][/formvariables][!][/!][formvariables name=exclusivelock][redirect /][/formvariables][!][/!][formvariables name=filecompare][redirect /][/formvariables][!][/!][formvariables name=fileinfo][redirect /][/formvariables][!][/!][formvariables name=findstring][redirect /][/formvariables][!][/!][formvariables name=flushcache][redirect /][/formvariables][!][/!][formvariables name=flushdatabases][redirect /][/formvariables][!][/!][formvariables name=format][redirect /][/formvariables][!][/!][formvariables name=format][redirect /][/formvariables][!][/!][formvariables name=formvariables][redirect /][/formvariables][!][/!][formvariables name=founditems][redirect /][/formvariables][!][/!][formvariables name=freememory][redirect /][/formvariables][!][/!][formvariables name=function][redirect /][/formvariables][!][/!][formvariables name=getchars][redirect /][/formvariables][!][/!][formvariables name=getcookie][redirect /][/formvariables][!][/!][formvariables name=getmimeheader][redirect /][/formvariables][!][/!][formvariables name=grep][redirect /][/formvariables][!][/!][formvariables name=hideif][redirect /][/formvariables][!][/!][formvariables name=html1][redirect /][/formvariables][!][/!][formvariables name=html2][redirect /][/formvariables][!][/!][formvariables name=html3][redirect /][/formvariables][!][/!][formvariables name=httpmethod][redirect /][/formvariables][!][/!][formvariables name=if][redirect /][/formvariables][!][/!][formvariables name=include][redirect /][/formvariables][!][/!][formvariables name=input][redirect /][/formvariables][!][/!][formvariables name=interpret][redirect /][/formvariables][!][/!][formvariables name=ipaddress][redirect /][/formvariables][!][/!][formvariables name=issecureclient][redirect /][/formvariables][!][/!][formvariables name=lastautonumner][redirect /][/formvariables][!][/!][formvariables name=lastrandom][redirect /][/formvariables][!][/!][formvariables name=lineitems][redirect /][/formvariables][!][/!][formvariables name=listchars][redirect /][/formvariables][!][/!][formvariables name=listcookies][redirect /][/formvariables][!][/!][formvariables name=listdatabases][redirect /][/formvariables][!][/!][formvariables name=listfields][redirect /][/formvariables][!][/!][formvariables name=listfiles][redirect /][/formvariables][!][/!][formvariables name=listmimeheaders][redirect /][/formvariables][!][/!][formvariables name=listpath][redirect /][/formvariables][!][/!][formvariables name=listvariables][redirect /][/formvariables][!][/!][formvariables name=listwords][redirect /][/formvariables][!][/!][formvariables name=lookup][redirect /][/formvariables][!][/!][formvariables name=lookup][redirect /][/formvariables][!][/!][formvariables name=loop][redirect /][/formvariables][!][/!][formvariables name=lowercase][redirect /][/formvariables][!][/!][formvariables name=math][redirect /][/formvariables][!][/!][formvariables name=middle][redirect /][/formvariables][!][/!][formvariables name=movefile][redirect /][/formvariables][!][/!][formvariables name=object][redirect /][/formvariables][!][/!][formvariables name=orderfile][redirect /][/formvariables][!][/!][formvariables name=password][redirect /][/formvariables][!][/!][formvariables name=platform][redirect /][/formvariables][!][/!][formvariables name=product][redirect /][/formvariables][!][/!][formvariables name=protect][redirect /][/formvariables][!][/!][formvariables name=purchase][redirect /][/formvariables][!][/!][formvariables name=random][redirect /][/formvariables][!][/!][formvariables name=raw][redirect /][/formvariables][!][/!][formvariables name=redirect][redirect /][/formvariables][!][/!][formvariables name=referrer][redirect /][/formvariables][!][/!][formvariables name=removehtml][redirect /][/formvariables][!][/!][formvariables name=removelineitem][redirect /][/formvariables][!][/!][formvariables name=replace][redirect /][/formvariables][!][/!][formvariables name=replacefounditems][redirect /][/formvariables][!][/!][formvariables name=return][redirect /][/formvariables][!][/!][formvariables name=returnraw][redirect /][/formvariables][!][/!][formvariables name=scope][redirect /][/formvariables][!][/!][formvariables name=search][redirect /][/formvariables][!][/!][formvariables name=sendmail][redirect /][/formvariables][!][/!][formvariables name=setcookie][redirect /][/formvariables][!][/!][formvariables name=setheader][redirect /][/formvariables][!][/!][formvariables name=setlineitem][redirect /][/formvariables][!][/!][formvariables name=setmimeheader][redirect /][/formvariables][!][/!][formvariables name=shell][redirect /][/formvariables][!][/!][formvariables name=showif][redirect /][/formvariables][!][/!][formvariables name=shownext][redirect /][/formvariables][!][/!][formvariables name=spawn][redirect /][/formvariables][!][/!][formvariables name=sql][redirect /][/formvariables][!][/!][formvariables name=sql][redirect /][/formvariables][!][/!][formvariables name=sqlconnect][redirect /][/formvariables][!][/!][formvariables name=sqldisconnect][redirect /][/formvariables][!][/!][formvariables name=sqlexecute][redirect /][/formvariables][!][/!][formvariables name=sqlinfo][redirect /][/formvariables][!][/!][formvariables name=sqlrelease][redirect /][/formvariables][!][/!][formvariables name=sqlresult][redirect /][/formvariables][!][/!][formvariables name=switch][redirect /][/formvariables][!][/!][formvariables name=table][redirect /][/formvariables][!][/!][formvariables name=tcpconnect][redirect /][/formvariables][!][/!][formvariables name=tcpsend][redirect /][/formvariables][!][/!][formvariables name=text][redirect /][/formvariables][!][/!][formvariables name=then][redirect /][/formvariables][!][/!][formvariables name=thisurl][redirect /][/formvariables][!][/!][formvariables name=time][redirect /][/formvariables][!][/!][formvariables name=unurl][redirect /][/formvariables][!][/!][formvariables name=uppercase][redirect /][/formvariables][!][/!][formvariables name=url][redirect /][/formvariables][!][/!][formvariables name=username][redirect /][/formvariables][!][/!][formvariables name=validcard][redirect /][/formvariables][!][/!][formvariables name=version][redirect /][/formvariables][!][/!][formvariables name=version][redirect /][/formvariables][!][/!][formvariables name=waitforfile][redirect /][/formvariables][!][/!][formvariables name=writefile][redirect /][/formvariables][!][/!][formvariables name=xmlnode][redirect /][/formvariables][!][/!][formvariables name=xmlnodes][redirect /][/formvariables][!][/!][formvariables name=xmlnodesattributes][redirect /][/formvariables][!][/!][formvariables name=xmlparse][redirect /][/formvariables][!][/!][formvariables name=xsl][redirect /][/formvariables][!][/!][formvariables name=xslt][redirect /][/formvariables][!][/!][!]--- END: to plug up the security hole of when URL hacker passes awebdna context name as a formvar---[/!]Daniel Meola301-486-0901daniel@knifecenter.comOn Wed, Dec 12, 2012 at 2:44 PM, Terry Wilson wrote:> This exploit was discovered a few years back, but I thought it was fixed,> or a fix was announced or something. I forget.>> Terry>>>> Hi,>>>> I am running V6.2 on CentOS 5.8 and have found instances where WebDNA>> code displays on a page if certain WebDNA tags are in the URL.>>>> I thought it was something I was doing but this appears to happen on the>> www.webdna.us site as well.>>>> http://www.webdna.us/page.dna?**text=>> takes you to a page that shows only webdna code>>>> http://www.webdna.us/page.dna?**numero=56&text=>> adds a line of text above the navigation row in the red background (need>> to mouse over to see it - text is same color as red background)>>>>>> I first experienced this with != and fixed it by putting a RewriteRule>> in an .htaccess file in the site's root folder>>>> Today I tried a few other tags and found others. I haven't checked all>> the tags just a handful.>>>> text=>> math=>> format=>>>> Anyone else experience this, have a fix or suggestion?>>>> Thanks,>> Steve>>>>>> ------------------------------**--------------------------->> This message is sent to you because you are subscribed to>> the mailing list .>> To unsubscribe, E-mail to: >> archives: http://mail.webdna.us/list/**talk@webdna.us>> Bug Reporting: support@webdna.us>>>>> --> Terry Wilson | terry@terryfic.com | http://terryfic.com> http://WhosComing.com - a simplified, affordable online reservation system> iStockPhoto portfolio - http://www.istockphoto.com/**> Terryfic3D?refnum=Terryfic3D> ------------------------------**------------------------------**> --------------> Attitude is the only difference between ordeal and adventure.>> ------------------------------**---------------------------> This message is sent to you because you are subscribed to> the mailing list .> To unsubscribe, E-mail to: > archives: http://mail.webdna.us/list/**talk@webdna.us> Bug Reporting: support@webdna.us>--e89a8ff1c85cb1967f04d0ad1e24Content-Type: text/html; charset=ISO-8859-1Content-Transfer-Encoding: quoted-printableYou include this at the top of all pages: