Security : Server side validation / SQL injection / XSS | Community
Skip to main content
A
Anonymous
November 18, 2013
Question

Security : Server side validation / SQL injection / XSS

  • November 18, 2013
  • 6 replies
  • 7432 views

Hi,

Our security scan on Marketo form is now revealing that Marketo form accepts invalid inputs such as HTML code etc.For example, <script>Alert(‘Hacked’);

This flaw may cause several security issues, such as SQL Injection, Cross site scripting (XSS), etc.

I do many researches on Marketo community and find no articles talking about how Marketo handle such invalid inputs/SQL injection/XSS on Marketo form.

Does Marketo have server side validation or any security mechanisms to validate invalid inputs and mitigate risks such as SQL injection, Cross site scripting (XSS), etc.? Any suggestion to overcome this security flaw is appreciated.

Thank you in advance for all comments.
Regards,
Taworn D.

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

6 replies

Tim_Tran5
Tim_Tran5
New Participant
August 27, 2019

Do we know if this critical security flaw been resolved? or its been 6+ years and Marketo has made no progress?

SanfordWhiteman
SanfordWhiteman
New Participant
August 27, 2019

Escape your output. That's how you deal with untrusted input (always).

Exactly what vulnerability exists when you properly escape output?

(And all user-supplied input should be considered untrusted, regardless of whether it's said to be "sanitized".)

Jonathan_Marzin
Jonathan_Marzin
New Participant
March 10, 2016

It's an old thread, but did anything come of this? How does Marketo account for SQL/HTML injection?

Kenny_Elkington
Kenny_Elkington
New Participant
March 10, 2016

I don't recall if anything came from this specific thread, but we take security seriously and employee modern security practices to combat XSS and SQL injection, in addition to many other attack vectors.  You can read more here: TRUST - Security and Customer Data Protection - Marketo

A
Anonymous
December 22, 2016

Well, we don't have that particular concern...in our case we have someone reading the form fields, then auto-submitting a few thousand per day with a 13-digit hex number in the name field. It's easy enough to filter that out of a smart list, but I want to keep it from getting into the db in the first place. Marketo just lets it in, no apparent way to insert some server-side filter that just drops the record.

    Kenny_Elkington
    Kenny_Elkington
    New Participant
    July 29, 2014
    Hi Domenic,

    Could you please log a support ticket demonstrating your concerns with regard to any potential XSS vulnerabilities?
    A
    Anonymous
    July 29, 2014
    An old issue, but I have seen the same problem. Any repsonse from Marketo?
    A
    Anonymous
    March 13, 2014
    I have the same concern.
    Can we disable form fields from allowing html?
    A
    Anonymous
    November 21, 2013
    to follow the discussion
    Terms & ConditionsAccessibility statement

    Loading footer...