Rev Potential exploit.

[Dan Smith]

Basicly. i belive that rev is xxs cross scriptable.

All thats needed is to set your motto to <script>alert('XXS')</script> and on online, it sends an alert.


Does anybody have a fix for this?

The fix will be largely appreciated!

Also, you may want to know:
Whats is XXS?

You must be registered for see links

-Dan

 

[Clit]

Ok so are you saying someone having their motto as "<script>alert('PENIS')</script>" it would not look unprofessional?

you're a wannabe fresh-hotel, you cannot tell me you are going to discipline for that.

 

[Tomm]

Ok so are you saying someone having their motto as "<script>alert('PENIS')</script>" it would not look unprofessional?

My exact point. At the end of the day, whatever you say, it is un-professional!

 

[Clit]

<script>alert('Devbest')</script>

30 char <3

33*

 

[Xyro]

tell me how you're gonna do that in 12 fucking characters..

Also...
<script>alert('PENIS')</script>
I was able to insert that into my motto and thats more than 12 characters. Learn to count.

 

[Tomm]

you're a wannabe fresh-hotel, you cannot tell me you are going to discipline for that.

If you want little kids writting immature messages on your /online page be our guests. Some people actually care.

 

[Dan Smith]

Filter is 30 char i think

 

[Clit]

My exact point. At the end of the day, whatever you say, it is un-professional!

No respect for this hotel now.

Yet, this is not about your hotel, its about the exploit.
No harm can possibly be done. Someone really come up with something 12 characters or less that will harm/malfunction/or change w/o permission your hotel/website

 

[Derpec]

What is this hotel's link may i have it please?

 

[Xyro]

you're a wannabe fresh-hotel, you cannot tell me you are going to discipline for that.

How exactly are they wannabe Fresh-hotel? That's actually really pathetic coming from you to be honest. If they wanted to be fresh, they'd be copying everything that Fresh does. But are they? No. You're flaming at a kid that could probably end up being the reason why RevCMS is more secure. Maybe the XSS script is a threat, maybe it's not but you need to stop hating on people who are actually bringing useful information into this community and start doing that yourself.

 

[Sledmore]

By default in RevCMS, you cannot change your motto? - Also, I'm almost sure it's filtered in Phoenix? (Could be wrong) - Thirdly, if your staff do this - you hired some fucking idiots.

 

[Tomm]

How exactly are they wannabe Fresh-hotel? That's actually really pathetic coming from you to be honest. If they wanted to be fresh, they'd be copying everything that Fresh does. But are they? No. You're flaming at a kid that could probably end up being the reason why RevCMS is more secure. Maybe the XSS script is a threat, maybe it's not but you need to stop hating on people who are actually bringing useful information into this community and start doing that yourself.

At the end of the day - it's not supposed to be there. Therefore, it's a problem and liable to be brought up on DevBest. Stop talking shit; you're wrong.

 

[Find]

No respect for this hotel now.

Yet, this is not about your hotel, its about the exploit.
No harm can possibly be done. Someone really come up with something 12 characters or less that will harm/malfunction/or change w/o permission your hotel/website

Actually if I went on a hotel an there was messages just popping up whenever I went on certain pages, that could say something like "cunt" etc. it would put me off the hotel To me thats seems like harm?

 

[Tomm]

By default in RevCMS, you cannot change your motto? - Also, I'm almost sure it's filtered in Phoenix? (Could be wrong) - Thirdly, if your staff do this - you hired some fucking idiots.

Every user can do this on the /online page, this is the problem.

 

[Sledmore]

Every user can do this on the /online page, this is the problem.

Can you PLEASE, read my post from start to end again?

 

[Legion]

Solution: Take out any forms to see someone else's Motto other than your own. (Staff page, Online users, ect..)

 

[Clit]

At the end of the day - it's not supposed to be there. Therefore, it's a problem and liable to be brought up on DevBest. Stop talking shit; you're wrong.

Opinion matter.

How exactly are they wannabe Fresh-hotel? That's actually really pathetic coming from you to be honest. If they wanted to be fresh, they'd be copying everything that Fresh does. But are they? No. You're flaming at a kid that could probably end up being the reason why RevCMS is more secure. Maybe the XSS script is a threat, maybe it's not but you need to stop hating on people who are actually bringing useful information into this community and start doing that yourself.

Really pathetic coming from me, as if thats supposed to mean something, not hating on anyone actually.

 

[Xyro]

At the end of the day - it's not supposed to be there. Therefore, it's a problem and liable to be brought up on DevBest. Stop talking shit; you're wrong.

lol how am i wrong?

 

[Tomm]

lol how am i wrong?

not you, i was using your post to back up my statement.

 

[Xyro]

not you, i was using your post to back up my statement.

Ah right lolzzz

 

[Find]

By default in RevCMS, you cannot change your motto? - Also, I'm almost sure it's filtered in Phoenix? (Could be wrong) - Thirdly, if your staff do this - you hired some fucking idiots.

If they change their motto via client it would appear on the online users page for their motto, and also it can't be seeing as we're using v3.8.1 licensed Phoenix and it works and like we've said multiple times it's not staff doing it thats a problem, it's users.