CSRF

[stevenlalwani]

Health.humongousmall.com

I have Sitelock on Humongousmall.com.

I received the following vulnerability warning on one of the sub domains:

URL:http://health.humongousmall.com/store/search/?=Find it!&price=1&tags=1&word=1
Cross site scripting vulnerability found in args:,price,tags,word

URL:http://health.humongousmall.com/store/search/?=Find it!&brand=1&price=1&tags=1&word=1
Cross site scripting vulnerability found in args:,brand,price,tags,word

URL:http://health.humongousmall.com/stor...&tags=1&word=1
Cross site scripting vulnerability found in args:,brand,price,tags,word

URL:http://health.humongousmall.com/stor...&tags=1&word=1
Cross site scripting vulnerability found in args:,brand,price,tags,word

URL:http://health.humongousmall.com/stor...&tags=1&word=1
Cross site scripting vulnerability found in args:,brand,price,tags,word

URL:http://health.humongousmall.com/stor...&tags=1&word=1
Cross site scripting vulnerability found in args:,brand,price,tags,word

URL:http://health.humongousmall.com/stor...&tags=1&word=1
Cross site scripting vulnerability found in args:brand,price,tags,word

URL:http://health.humongousmall.com/stor...&tags=1&word=1
Cross site scripting vulnerability found in args:brand,price,tags,word

URL:http://health.humongousmall.com/stor...&tags=1&word=1
Cross site scripting vulnerability found in args:brand,price,tags,word

URL:http://health.humongousmall.com/stor...&tags=1&word=1
Cross site scripting vulnerability found in args:brand,price,tags,word

URL:http://health.humongousmall.com/stor...&tags=1&word=1
Cross site scripting vulnerability found in argsrice,tags,word

URL:http://health.humongousmall.com/stor...&tags=1&word=1
Cross site scripting vulnerability found in argsrice,tags,word

URL:http://health.humongousmall.com/stor...&tags=1&word=1
Cross site scripting vulnerability found in argsrice,tags,word

URL:http://health.humongousmall.com/stor...&tags=1&word=1
Cross site scripting vulnerability found in argsrice,tags,word


How do fix this?

[Eric]

Hi

You should ask Sitelock how to go about fixing those. They are the ones that will know why those URLs are triggering XSS vulnerability messages.

Eric

[stevenlalwani]

Is the datafeeedr plugin protected against CSRF, malware injection,
especially the Search bars?

[Eric]

Yes.