Your scanner is unable tell if it is vulnerable or not, which is why it says it is "possibly" vulnerable to SQL injection attacks. If you look at the scripts you will see there is no place where user input is directly placed into a SQL statement. Thus, the scripts are not vulnerable to SQL injection.Quote:
Tested with Acunetix web vulnerability scanner 8
Results:
This script is possibly vulnerable to SQL Injection attacks.
SQL injection is a vulnerability that allows an attacker to alter backend SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly placed into a SQL statement and doesn't properly filter out dangerous characters.
This is one of the most common application layer attacks currently being used on the Internet. Despite the fact that it is relatively easy to protect against, there is a large number of web applications vulnerable.
This vulnerability affects /registration/changepass.php.
Discovered by: Scripting (Blind_Sql_Injection.script).
The purpose of ReCaptcha is to prevent people from botting account creation. It has no effect at all in regards to SQL injection.Quote:
^ Exactly. There is no possible SQL injection through those scripts, even using TamperData to manually edit the data in transit SQLi is blocked. There is however confirmed XSS in the input fields. If you put in code it is reflected back to the user. Although the type of XSS isn't even remotely high impact the code should probably be changed up a bit to provide better input sanitization (I would do it but I am a horrible coder).Quote:
Your scanner is unable tell if it is vulnerable or not, which is why it says it is "possibly" vulnerable to SQL injection attacks. If you look at the scripts you will see there is no place where user input is directly placed into a SQL statement. Thus, the scripts are not vulnerable to SQL injection.
You are correct about the XSS in a sense. You can only XSS yourself with it, which I can't think of a single useful reason to do that. Also in that context it would not really be cross site scripting, since only you can see it, and not everyone accessing the site.Quote:
Kudos on the scripts Abrasive.
Also, you can't rely to heavily on the output from vulnerability scanners as they tend to only test heuristics instead of actually trying the attack vector. Heuristic scanners are always prone to give out false positives. This is true of Acunetix, WebSecurify, W3AF, Arachni, Nessus, OpenVAS, etc. They are useful for giving you an idea of where a vulnerability may be present, but you always need to test it yourself before you can really know for sure.
Yeah that's why I said it wasn't even remotely high impact. In the context of the Registration Script as is, it isn't even close to XSS, but that's only if you are using traditional methods for XSS such as javascript or html (iframes, anchors, etc.) BUT since XSS can actually be exploited through any scripting language, it becomes a bit more of an issue if you use other scripting languages. ;)Quote:
It is still my bad for overlooking the htmlentities() call in the view though -.-