[36984] in bugtraq

home	help	back	first	fref	pref	prev	next	nref	lref	last	post

Re: IBM Lotus Notes/Domino fails to encode Square Brackets ( [ ]

daemon@ATHENA.MIT.EDU (Juan C Calderon)
Mon Oct 18 18:00:04 2004

Date: 18 Oct 2004 21:31:03 -0000
Message-ID: <20041018213103.16697.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Juan C Calderon <juan.calderon@ge.com>
To: bugtraq@securityfocus.com

In-Reply-To: <20041018184817.32681.qmail@www.securityfocus.com>

Regarding the Trivial example I sent:

>>http://www.SomeLotusSite.com/FormReflectingURLValue?OpenForm&Field=[&lt;script&gt;.....&lt;/script&gt;]

Please replace &lt; with "Less Than" character and &gt; with "greater than" character for this to work, looks like those characters where doble encoded (for obvious security reasons) when posted.

Here is the URL encoded version as well:
http://www.SomeLotusSite.com/FormReflectingURLValue?OpenForm&Field=%5B%3Cscript%3E%2E%2E%2E%2E%2E%3C%2Fscript%3E%5D

&lt; Regards

home	help	back	first	fref	pref	prev	next	nref	lref	last	post