Hi Joe,

I have scanned the site by PCI compilation tool.

So, i am getting vulnerability issue such as "DOMbased Cross Site Scripting Vulnerability".

Error Description : Line 350:Unsafe client
output setting form.action to tainted
value
Line 350:"window.location.href" is
controlled by the user

we are getting this issue in all pages, it is javascript related issue and it is in mojo portal code.

Please suggest how to overcome this issue.

Thanks,

Prafull

Hi,

I am not using any external javascript in mojoPortal code.

I am getting scripting error, check description as below,

Description :

The website or application is vulnerable to DOMbased crosssitescripting (XSS).

Crosssite scripting allows a malicious attacker to trick your web application
into emitting the JavaScript or HTML code of his choice. This malicious code will appear to come from your web application when it runs in the browser of an unsuspecting user.
Whereas traditional XSS takes advantage of vulnerable backend
CGI scripts to directly emit the code into served pages, DOMbased XSS takes advantage
of vulnerable JavaScript scripts which execute directly in the user's browser. For example, a the following vulnerable script can be used to launch an XSS attack:
var loc = document.location + '?gotoHomepage=1';
document.write('<a href="' + loc + '">Home</a>');
In this case, the JavaScript variable "document.location" is under the direct control of an attacker, but it is being written directly into the document content
without escaping. An attacker could construct a URL containing <script> tags in it and trick an unsuspecting user into visiting the vulnerable website. A URL
such as http://your_application/index.html?"><script>alert(document.cookie)</script> can be constructed that would cause the script above to write the
attacker's malicious script tags directly into the user's document, where they will be executed.
• An exploit script can be made to: access other sites inside another client's private intranet.
• steal another client's cookie(s).

Thanks

Prafull