Actions
Bug #16943
closed
JP
JP
Potential XSS in PPP instance Provider and Plan fields
Bug #16943:
Potential XSS in PPP instance Provider and Plan fields
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
When editing a PPP instance on interfaces_ppps_edit.php the Provider and Plan fields are not validated and store any value submitted by the user. The actual provider and plan fields are not as important as they mostly provide a means to pre-fill the other fields on the page. The stored provider and plan values do get placed into and used by a JavaScript, however, which opens the potential for XSS.
Submitting the form with a specially-crafted value for provider and/or providerplan such as value='");alert(`XSS`);//' (mind the single vs double quotes) will trigger the issue.
Files
Actions