RE: [PHP] Zend studio location Cross-Domain Scripting Vulnerability
| From: | Daevid Vincent | Date: | Wed, 13 Oct 2010 19:40:02 +0000 |
| Subject: | RE: [PHP] Zend studio location Cross-Domain Scripting Vulnerability | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-308685@lists.php.net to get a copy of this message | ||
> -----Original Message-----
> From: Thijs Lensselink [mailto:dev@lenss.nl]
> Sent: Tuesday, October 12, 2010 9:26 PM
> To: php-general@lists.php.net
> Subject: Re: [PHP] Zend studio location Cross-Domain
> Scripting Vulnerability
>
> On 10/13/2010 12:19 AM, Daevid Vincent wrote:
> >
> > http://80vul.com/Zend%20studio/Zend%20studio%20location%20Cross.htm
> >
> > Interesting. A co-worker and I were JUST noticing how our
> PHPDoc comments
> > were being parsed pretty much verbatim including<b> tags
> and links and
> > stuff and thought, "wow, that's stupid, that's just a XSS
> or injection
> > waiting to happen". LOL. Guess someone's ears were burning. ;-)
> >
> >
>
> Why didn't you inform Zend before you went full disclosure?
>
> It's a nasty bug though!!
You misunderstand. *I* did not write that web page. It was just coincidence
that *I* encountered the same thing the other day and then someone on
Reddit posted that URL. That's all. Timing.
Thought I'd share with the PHP community here though since many of us use
Zend (and perhaps PDT and Aptana have the same issue?)
d