Home/ Questions/Q 7642315
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-31T09:09:30+00:00

Using the POST HTTP method, Site Scanner found that : The following resources may

  • 0

Using the POST HTTP method, Site Scanner found that :

  • The following resources may be vulnerable to cross-site scripting (extended patterns) :
  • The ’email’ parameter of the /customer/account/forgotpasswordpost/ CGI :
    /customer/account/forgotpasswordpost/ [email=508 src=http://www.example.
    com/exploit508.js]

As far I see code, Magento senitize the _GET/_POST. How can I get fixed this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I guess this will depend on what version of Magento you are running. The default location for the template in question can be found at app/design/frontend/base/default/template/customer/form/forgotpassword.phtml. The only value that is user editable that is echo’d out to the screen is the e-mail address, certainly in Magento 1.6 this is being passed through the template blocks htmlEscape method, but it’s worth checking that it is in your version of Magento.

    <input type="text" name="email" alt="email" id="email_address" class="input-text required-entry validate-email" value="<?php echo $this->htmlEscape($this->getEmailValue()) ?>" />

    If you find that it already is then it would be worth checking that this template isn’t being overloaded in your current theme.

    • 0