AppSec Blog: Author - Billy Rios

Details Affected Software: PunBB Fixed in Version: 1.3 Issue Type: Cross Site Scripting (XSS) Original Code: Found Here Description Passwords, passwords, passwords. For some reason, developers sometimes assume passwords values are safe and do not need encoding. In this example, the developers chose to encode username values (line 87) however, they assumed password values would … Continue reading Spot the Vuln - Banks - Cross Site Scripting

I have always been afraid of banks. - Andrew Jackson Spot the Vuln uses code snippets from open source applications to demonstrate vulnerabilities in real world web applications. Every Monday morning a vulnerable code snippet is posted. Take a look at the vulnerable code and try to identify where the security vulnerability is. Every Friday, … Continue reading Spot the Vuln - Banks

Details Affected Software: PunBB Fixed in Version: 1.3 Issue Type: SQL Injection (SQLi) Original Code: Found Here Description This week's bug was an old SQL injection bug that affected PunBB versions < 1.3. In short, a value is taken from an attacker/user controlled POST request and is used to build a SQL statement. This bug … Continue reading Spot the Vuln - Tougher - SQL Injection

I survived because I was tougher than anybody else. - Bette Davis Spot the Vuln uses code snippets from open source applications to demonstrate vulnerabilities in real world web applications. Every Monday morning a vulnerable code snippet is posted. Take a look at the vulnerable code and try to identify where the security vulnerability is. … Continue reading Spot the Vuln - Tougher

Details Affected Software: PunBB Fixed in Version: 2.1 Issue Type: Cross Site Scripting (XSS) Original Code: Found Here Description This week's vulnerability was a XSS bug in PunBB. PunBB was taking an un-trusted value directly from the POST parameter ($_POST[''prune_sticky']) and echoing the un-trusted value directly into a value attribute for a hidden form input … Continue reading Spot the Vuln - Price - Cross Site Scripting