PCI 合规性资源/服务？修复“类别参数中的跨站点脚本漏洞”漏洞？
一家审计公司表示我们不符合 PCI 标准，但就如何解决问题提供了无用的指示。他们显然希望我们聘请他们的咨询部门。
在收到 PCI 合规性审核警报后，您使用了哪些资源/服务来弥补差距？
是否有网站提供有关解决 PCI 合规性问题的有用资源？
例如，这是我们被标记的神秘故障消息之一：
“描述：URL X 的类别参数中存在跨站点脚本漏洞”，
但没有关于如何关闭此漏洞的明确指导。
谢谢。
An auditing firm said we are not PCI compliant, but provided unhelpful instructions on how to resolve the issues. They are clearly hoping we will engage their consulting unit.
What resources/services have you used to plug gaps after receiving a PCI compliance audit alert?
Are there web sites that provide helpful resources on resolving PCI compliance issues?
For instance, here is one of the cryptic failure messages we were flagged on:
"Description: Cross-site scripting vulnerability in category parameter to URL X"
But there is no clear guidance on how to close this vulnerability.
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
他们是否说明了哪个 URL 导致了该漏洞，或者它实际上是一个“X”？
检查以确保没有经过适当清理的用户输入或从 URL 抓取的输入显示在页面上的任何位置（或在 JavaScript 中使用）。
如果您发布 URL，我相信这里的人们会很乐意寻找该漏洞。
[发布 URL 后进行编辑：]
以下是显示漏洞的格式错误的请求的链接：
http://www.cengraving.com/s/category?category=Outdoor+signs+'-'alert("Cross%20Site%20Scripting%20Vulnerability%20Here");
一种方法防止这种攻击的方法是验证所有用户输入。
客户端您可以删除任何可疑字符，例如 <>'" -
服务器端您应该使用正则表达式将有效查询列入白名单，然后再将其输入数据库。
Did they say which URL is causing the vulnerability, or was it literally an "X"?
Check to make sure that no user input, or input that is being grabbed from the URL, is being displayed anywhere on the page (or being used in your javascript) without being properly sanitized.
If you post the URL I'm sure people here would be happy to look for the vulnerability.
[Edit after you posted the URL:]
Here is a link to a malformed request displaying the vulnerability:
http://www.cengraving.com/s/category?category=Outdoor+signs+'-'alert("Cross%20Site%20Scripting%20Vulnerability%20Here");
A way to prevent this attack would be to validate all user input.
Client side you can remove any suspicious characters like <>'"-
Server side you should use regex to whitelist valid queries before entering them into your database.