xss - magento - hackers or exploit -

-


xss - magento - hackers or exploit -

i found these entries in magento log file. not sure if hackers attempting come in enter bad data, or evidence of exploit. log file:

var/log/exception.log:4118:2014-10-30t22:46:39+00:00 debug (7): exception message: no date part in '<?import namespace="crosssitescripting" implementation="http://ha.ckers.org/crosssitescripting.htc">' found. var/log/exception.log:4131:exception 'zend_locale_exception' message 'no date part in '<?import namespace="crosssitescripting" implementation="http://ha.ckers.org/crosssitescripting.htc">' found.' in lib/zend/locale/format.php:869 var/log/exception.log:4352:2014-10-30t22:46:49+00:00 debug (7): exception message: no date part in '<script src=http://ha.ckers.org/xss.js></script>' found. var/log/exception.log:4365:exception 'zend_locale_exception' message 'no date part in '<script src=http://ha.ckers.org/xss.js></script>' found.' in lib/zend/locale/format.php:869 var/log/exception.log:4534:2014-10-30t22:46:55+00:00 debug (7): exception message: no date part in '<script/xss src="http://ha.ckers.org/xss.js"></script>' found. var/log/exception.log:4547:exception 'zend_locale_exception' message 'no date part in '<script/xss src="http://ha.ckers.org/xss.js"></script>' found.' in lib/zend/locale/format.php:869

they appear coming function in lib/zend/locale/format.php - line 869

private static function _parsedate($date, $options)

relevant code is:

// split number parts $split = false; preg_match_all('/\d+/u', $number, $splitted); if (count($splitted[0]) == 0) { iconv_set_encoding('internal_encoding', $oenc); #require_once 'zend/locale/exception.php'; throw new zend_locale_exception("no date part in '$date' found."); } if (count($splitted[0]) == 1) { $split = 0; } $cnt = 0; foreach($parse $key => $value) {

the log file entries shows evidence of attempting identify cross site scripting vulnerability. based on code snippet provided not vulnerable.

magento xss exploit

Comments

Post a Comment

Popular posts from this blog

Using Android Volley to post an array to PHP -

-
Using Android Volley to post an array to PHP - this how post values volley: @override protected map<string, string> getparams() { jsonobject jsonobjectmembers=new jsonobject(); (int i=0; i<arr_added_userids.size(); i++) { seek { jsonobjectmembers.put("params_"+i,arr_added_userids.get(i)); } grab (jsonexception e) { e.printstacktrace(); } } map<string, string> params = new hashmap<string, string>(); params.put("host", session_userid); params.put("params",jsonobjectmembers.tostring()); homecoming params; } this tried: foreach($_post['params'] $key => $value) { seek { $stmt = $conn->prepare("insert crewmembers (crewid, member) values (:crewid, :member)"); $query_params = array( ':crewid' => $crewid, ':member' => $value ); ...
Read more

python - How to add an model instance to a django queryset? -

-
python - How to add an model instance to a django queryset? - it seems django queryset behaves somehow python list. but doesn't back upwards list's .append() method know. what want like: from my_django_app.models import mymodel queryset = mymodel.objects.none() queryset.append(mymodel.objects.first()) ## no list's .append() method! is there way add together model instance existing queryset? no. queryset representation of query - hence name - not arbitrary collection of instances. if need actual queryset rather list, seek accumulating ids of objects need , getting objects via __in query: list_of_ids = [] list_of_ids.append(my_id) ... queryset = mymodel.objects.filter(id__in=list_of_ids) this isn't efficient, though. python django
Read more

angularjs - No 'Access-Control-Allow-Origin' error from local domain to public API -

-
angularjs - No 'Access-Control-Allow-Origin' error from local domain to public API - i'm trying create app retrieve stock name, asking , purchase cost yahoo finance api, using restangular. i'm having problem accessing public api in local application i'm creating when request. url parameters i'm sending: http://finance.yahoo.com/d/quotes.csv?s=msft+ge&f=nab using postman, request returns array contains stock name, asking cost , purchase cost of stock. doing request in postman returns desired info without errors. when request in local, next error: xmlhttprequest cannot load http://finance.yahoo.com/d/quotes.csv?s=msft+ge&f=nab. no 'access-control-allow-origin' header nowadays on requested resource. origin 'http://localhost' hence not allowed access. the html code follows: <html ng-app="app"> <head> <title>restangular</title> <script src="https://ajax.googleapis.com/ajax/li...
Read more