I have a client who got a security check done on their site (they are a security company) and they came back with this in relation to an expresso store checkout:
- Checkout functionality
Although there was good input filtering in place on the checkout functionality, the team were able to inject html tags into the response. An attacker with sufficient time would likely to be able to construct a viable XSS payload. The following parameters were found to be vulnerable:
/shop/checkout [billing_address1 parameter]
/shop/checkout [billing_address2 parameter]
/shop/checkout [billing_city parameter]
/shop/checkout [billing_first_name parameter]
/shop/checkout [billing_last_name parameter]
/shop/checkout [billing_phone parameter]
/shop/checkout [billing_postcode parameter]
/shop/checkout [order_email parameter]
The team also observed that these values are stored in a database, meaning stored XSS attacks are feasibly possible, although the team could not identify a location where the values are subsequently output.
Basically, I can enter
<script> into the field inputs, which comes back as [removed] in my form, which is great. But I was able to add the following into my input field for the billing name:
And it saved this into the database along with my name.
So my real question is: what are the security implications of this, and is there a 'dictionary of bad things' file somewhere I can add the above tags to in EE that when submitted, my form will come back with [removed] like it did with the script tag?