hoo2/InformationSystemsSecurity
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: hoo2:4b5d0dd704ad4675a6d2abe59c1ca5e02bdade0a
Branches Tags
hoo2:master
hoo2:fix/http
hoo2:fix/root
hoo2:fix/pltxt
hoo2:fix/xss
hoo2:fix/sqli
hoo2:v1.0
hoo2:fix-http
hoo2:fix-root
hoo2:fix-pltxt
hoo2:fix-xss
hoo2:fix-sqli
hoo2:baseline
..
compare: hoo2:3bdb2b0a6a1302ce5bd65b8084aea03567d29132
Branches Tags
hoo2:master
hoo2:fix/http
hoo2:fix/root
hoo2:fix/pltxt
hoo2:fix/xss
hoo2:fix/sqli
hoo2:v1.0
hoo2:fix-http
hoo2:fix-root
hoo2:fix-pltxt
hoo2:fix-xss
hoo2:fix-sqli
hoo2:baseline

2 Commits
4b5d0dd704 ... 3bdb2b0a6a

Author SHA1 Message Date
Christos Choutouridis
3bdb2b0a6a Fix XSS by applying context-aware encoding 2026-01-11 15:40:59 +02:00
Christos Choutouridis
34898059d9 Prepare XSS environment and XSS attack proof 2026-01-11 15:18:17 +02:00
3 changed files with 21 additions and 76 deletions
Show Stats Expand all files Collapse all files

58
passman-dev/php/passman/dashboard.php
View File

@ -26,23 +26,12 @@ if(isset($_POST['new_website'], $_POST['new_username'], $_POST['new_password'])
$new_username = trim($_POST["new_username"]);
$new_password = trim($_POST["new_password"]);
// Insert new web site using a prepared statement to prevent SQL injection.
$sql_query = "INSERT INTO websites (login_user_id, web_url, web_username, web_password) VALUES " .
"((SELECT id FROM login_users WHERE username = ?), ?, ?, ?)";
$stmt = $conn->prepare($sql_query);
if ($stmt === false) {
$conn->close();
die("Prepare failed.");
}
$stmt->bind_param("ssss", $username, $new_website, $new_username, $new_password);
// Insert new web site
$sql_query = "INSERT INTO websites (login_user_id,web_url,web_username,web_password) VALUES " .
"((SELECT id FROM login_users WHERE username='{$username}'),'{$new_website}','{$new_username}','{$new_password}');";
//echo $sql_query;
$result = $stmt->execute();
$stmt->close();
$conn->close();
$result = $conn->query($sql_query);
$conn -> close();
// After processing, redirect to the same page to clear the form
unset($_POST['new_website']);
@ -56,25 +45,11 @@ if(isset($_POST['new_website'], $_POST['new_username'], $_POST['new_password'])
if(isset($_POST['delete_website']) && trim($_POST["websiteid"] != '')) {
$webid = trim($_POST["websiteid"]);
// Cast to int to avoid unexpected input and use a prepared statement to prevent SQL injection.
$webid = (int)trim($_POST["websiteid"]);
// Delete selected web site
$sql_query = "DELETE FROM websites WHERE webid = ?";
$stmt = $conn->prepare($sql_query);
if ($stmt === false) {
$conn->close();
die("Prepare failed.");
}
$stmt->bind_param("i", $webid);
$sql_query = "DELETE FROM websites WHERE webid='{$webid}';";
//echo $sql_query;
$result = $stmt->execute();
$stmt->close();
$conn->close();
$result = $conn->query($sql_query);
$conn -> close();
// After processing, redirect to the same page to clear the form
unset($_POST['websiteid']);
@ -82,21 +57,10 @@ if(isset($_POST['delete_website']) && trim($_POST["websiteid"] != '')) {
exit();
}
// Display list of user's web sites using a prepared statement to prevent SQL injection.
$sql_query = "SELECT * FROM websites INNER JOIN login_users ON websites.login_user_id=login_users.id WHERE login_users.username = ?";
// Display list of user's web sites
$sql_query = "SELECT * FROM websites INNER JOIN login_users ON websites.login_user_id=login_users.id WHERE login_users.username='{$username}';";
//echo $sql_query;
$stmt = $conn->prepare($sql_query);
if ($stmt === false) {
$conn->close();
die("Prepare failed.");
}
$stmt->bind_param("s", $username);
$stmt->execute();
$result = $stmt->get_result();
$stmt->close();
$result = $conn->query($sql_query);
//echo htmlspecialchars($username);
echo "<h3>Entries of " . $username . "</h3>";

17
passman-dev/php/passman/notes.php
View File

@ -50,24 +50,13 @@ if(isset($_POST['new_note']) && trim($_POST['new_note']) !='') {
//$sql_query = "INSERT INTO notes (login_user_id,note) VALUES " .
// "((SELECT id FROM login_users WHERE username='{$username}'),('{$new_note}'));";
// Insert new note using a prepared statement to prevent SQL injection.
$sql_query = "INSERT INTO notes (login_user_id, note) ".
"VALUES ((SELECT id FROM login_users WHERE username = ?), ?)";
"VALUES ((SELECT id FROM login_users WHERE username='{$username}'), '{$new_note}')";
$stmt = $conn->prepare($sql_query);
if ($stmt === false) {
// Fail closed (do not leak DB details).
$conn->close();
die("Prepare failed.");
}
$stmt->bind_param("ss", $username, $new_note);
//echo $sql_query;
$result = $stmt->execute();
$stmt->close();
$conn->close();
$result = $conn->query($sql_query);
$conn -> close();
// After processing, redirect to the same page to clear the form
unset($_POST['new_note']);

16
passman-dev/php/passman/register.php
View File

@ -29,19 +29,11 @@ if ($_SERVER["REQUEST_METHOD"] === "POST") {
//}
require_once __DIR__ . "/config.php";
// Insert a new user using a prepared statement to prevent SQL injection.
$sql_query = "INSERT INTO login_users (username, password) VALUES (?, ?)";
$stmt = $conn->prepare($sql_query);
if ($stmt === false) {
$login_message = "Database error (prepare failed).";
$result = false;
} else {
$stmt->bind_param("ss", $new_username, $new_password);
$result = $stmt->execute();
$stmt->close();
}
// Insert a new user
$sql_query = "INSERT INTO login_users (username,password) VALUES ('{$new_username}','{$new_password}');";
//echo $sql_query;
$result = $conn->query($sql_query);
unset($_POST['new_username']);
unset($_POST['new_password']);