The Cross Site Scripting FAQ06/06/2002 06:01 AM Websites today are more complex than ever, containing a lot of dynamic
content making the
experience for the user more enjoyable. Dynamic content is achieved
through the use of web
applications which can deliver different output to a user depending on
their settings and needs.
Dynamic websites have a threat that static websites don't, called
"Cross Site Scripting" (or XSS
dubbed by other security professionals). Currently small informational
tidbits about Cross Site
Scripting holes exist but none really explain them to an average
person or administrator. This
FAQ was written to provide a better understanding of this emerging
threat, and to give guidance
on detection and prevention.
“Two vulnerabilities have been reported in Comersus, allowing
malicious people to conduct SQL injection and cross-site scripting
attacks….Reportedly, this affects version 5.098 and prior.
Solution: Edit the source code to ensure that input is properly
sanitised.”…