How to fix XSS vulnerability yii on 404 page

Yii 2.0 General Discussions
1

i have problem XSS vulnerability my website on page 404
Open the url PASTE IT HEAR " (wITHOUT QOUTES) open this url and input the following payload "><svg/onload=alert(“XSS”)> You will see an XSS popup
how to fix it !
thank you

2

What version of Yii do you have? Tried updating to latest?

1 Like
3

i’m using yii2

4

Which version exactly?

5

Hi Vanchienbmt,

Are you using proper encoding when you get data from users?

for example

Html::encode()

If you’re using proper echo and encoding standard then most cases you won’t get XSS attacks…

Happy Coding…

6

Also with the above, you could strip_tags.

https://www.php.net/manual/en/function.strip-tags.php