1

Basit Submit Module Cross Site Scripting Vulnerability

DCP-Portal Cross Site Scripting Bugs, CVE-2004-2511 CVE- 2003-1536 CVE-2004-2512

These two vulnerabilities have been identified in the scan done against our website by a 3rd party reviewer. I'm unable to resolve these issues. Can anyone shed some light on these and how to resolve them?

  • 1
    1st nvd.nist.gov/vuln/detail/CVE-2004-2511 2nd nvd.nist.gov/vuln/detail/CVE-2003-1536 3rd nvd.nist.gov/vuln/detail/CVE-2004-2512 . Found some information on each of these, it also contains additional resources. – Alex Probert Apr 8 at 11:14
  • @AlexProbert Thanks for the information, sir but I've already gone through much more information regarding both Basit submit module and DCP-Portal. I'm not able to find a clear solution to mitigate the issue. I don't even know how these two are working as I'm not aware of their presence on the server. My server is Apache (Ubuntu) with wordpress installed. Also, do you know any alternatives to DCP-portal or Basit? – user204082 Apr 8 at 11:44
  • I suppose the best option is to look at techniques to prevent XSS, such as tag stripping. – Alex Probert Apr 8 at 12:03
  • @AlexProbert Can you tell how can I implement it on my apache server? – user204082 Apr 8 at 12:27
  • So the tag stripping would be in the HTML and regarding the apache (I'm not too sure what version you're running) geekflare.com/http-header-implementation seems like a good place to start, looking at the HTTP Headers. – Alex Probert Apr 8 at 12:33
0

As previously mentioned in the comments of the question.

It will be best to look at the HTTP headers

I have included an answer to a previous question, which can be used to address these issues.

https://stackoverflow.com/a/10369475/4962088

https://geekflare.com/http-header-implementation/

It is also worth looking at validation when creating a website/web application, which can be seen using the link below.

https://stackoverflow.com/a/1996141/4962088

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.