possible attack when joining as couple

I don't know but i think someone tryed to join my site as couple and i did get this mail sent to me :

Total impact: 8
Affected tags: xss, csrf, id, rfe

Variable: REQUEST.Desc | Value: Select \"Couple\" if you are joining as a couple
Impact: 4 | Tags: xss, csrf, id, rfe
Description: Detects JavaScript language constructs | Tags: xss, csrf, id, rfe | ID: 20

Variable: POST.Desc | Value: Select \"Couple\" if you are joining as a couple
Impact: 4 | Tags: xss, csrf, id, rfe
Description: Detects JavaScript language constructs | Tags: xss, csrf, id, rfe | ID: 20

REMOTE_ADDR: xxxxxxxxxxxxxx
HTTP_X_FORWARDED_FOR:
HTTP_CLIENT_IP:

This one when i add a facebook script widge to the html block :

Total impact: 12
Affected tags: sqli, id, lfi

Variable: REQUEST.fbsetting_a707eb03c91f5dcaf6771d351177b05a | Value: {\"connectState\":2,\"oneLineStorySetting\":3,\"shortStorySetting\":3,\"inFacebook\":false}
Impact: 6 | Tags: sqli, id, lfi
Description: Detects classic SQL injection probings 2/2 | Tags: sqli, id, lfi | ID: 43

Variable: COOKIE.fbsetting_a707eb03c91f5dcaf6771d351177b05a | Value: {\"connectState\":2,\"oneLineStorySetting\":3,\"shortStorySetting\":3,\"inFacebook\":false}
Impact: 6 | Tags: sqli, id, lfi
Description: Detects classic SQL injection probings 2/2 | Tags: sqli, id, lfi | ID: 43
Centrifuge detection data  Threshold: 3.49  Ratio: 2.5

REMOTE_ADDR: xxxxxxxxxxx
HTTP_X_FORWARDED_FOR:
HTTP_CLIENT_IP:

For your information ,  i did upload the lastest changes stated here ( i think it doesn't include the fix for the facebook or join as couple )------>http://www.boonex.com/trac/dolphin/changeset/13237

Thanks.

Proud Hosted by Zarconia.net
Quote · 16 Nov 2009
 
 
Below is the legacy version of the Boonex site, maintained for Dolphin.Pro 7.x support.
The new Dolphin solution is powered by UNA Community Management System.