Project

General

Profile

Actions
Copy link

Bug #16943

closed
JP JP

Potential XSS in PPP instance Provider and Plan fields

Bug #16943: Potential XSS in PPP instance Provider and Plan fields

Added by Jim Pingle 2 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
PPP Interfaces
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

When editing a PPP instance on interfaces_ppps_edit.php the Provider and Plan fields are not validated and store any value submitted by the user. The actual provider and plan fields are not as important as they mostly provide a means to pre-fill the other fields on the page. The stored provider and plan values do get placed into and used by a JavaScript, however, which opens the potential for XSS.

Submitting the form with a specially-crafted value for provider and/or providerplan such as value='");alert(`XSS`);//' (mind the single vs double quotes) will trigger the issue.

Files

16943.patch (1.2 KB) 16943.patch Jim Pingle, 07/10/2026 06:26 PM

JP Updated by Jim Pingle 2 months ago Actions
Copy link
 #2

Fixed in commit fa333276c5ae97e27974e3b33d17da5919b4bdda

Added encoding to the output. Also fixed a JS error.

Patch is attached.

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #3

  • Status changed from Feedback to Resolved

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #4

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom