Anonymous | Login | Signup for a new account | 2021-01-16 20:48 GMT | ![]() |
Main | My View | View Issues | Change Log | Roadmap |
View Issue Details [ Jump to Notes ] | [ Issue History ] [ Print ] | ||||||||
ID | Project | Category | View Status | Date Submitted | Last Update | ||||
0001655 | SiT! | security | public | 2011-08-06 11:42 | 2011-08-31 15:00 | ||||
Reporter | ivan | ||||||||
Assigned To | ivan | ||||||||
Priority | normal | Severity | major | Reproducibility | have not tried | ||||
Status | resolved | Resolution | fixed | ||||||
Platform | OS | OS Version | |||||||
Product Version | Current GIT | ||||||||
Target Version | 3.90beta1 | Fixed in Version | Current GIT | ||||||
Summary | 0001655: XSS: Possible to inject javascript into ldap_browser | ||||||||
Description | ldap_browse.php uses an external variable to create javascript code without stripping any potentially dangerous input. | ||||||||
Tags | No tags attached. | ||||||||
Attached Files | |||||||||
![]() |
|
ivan (administrator) 2011-08-21 11:56 |
<script type='text/javascript'> //<![CDATA[ ldap_browse_select_container('<?php echo $base ?>', '<?php echo $field ?>'); //]]> </script> While $base and $field have both been through cleanvar() - that function does not strip malicious javascript code. |
paulh (administrator) 2011-08-24 20:00 |
Agree |
ivan (administrator) 2011-08-31 15:00 |
Fixed in Git 236e762 |
![]() |
|||
Date Modified | Username | Field | Change |
2011-08-06 11:42 | ivan | New Issue | |
2011-08-06 11:42 | ivan | Status | new => assigned |
2011-08-06 11:42 | ivan | Assigned To | => ivan |
2011-08-06 11:42 | ivan | Assigned To | ivan => |
2011-08-06 11:42 | ivan | Status | assigned => new |
2011-08-21 11:56 | ivan | Note Added: 0004250 | |
2011-08-24 20:00 | paulh | Note Added: 0004259 | |
2011-08-24 20:00 | paulh | Status | new => confirmed |
2011-08-31 14:59 | ivan | Assigned To | => ivan |
2011-08-31 14:59 | ivan | Status | confirmed => assigned |
2011-08-31 15:00 | ivan | Note Added: 0004274 | |
2011-08-31 15:00 | ivan | Status | assigned => resolved |
2011-08-31 15:00 | ivan | Fixed in Version | => Current GIT |
2011-08-31 15:00 | ivan | Resolution | open => fixed |
Copyright © 2000 - 2021 MantisBT Team |