Project

General

Profile

Actions

Bug #3461

closed

XSS - package system

Added by Fernando Munoz over 7 years ago. Updated over 7 years ago.

Status:
Resolved
Priority:
High
Assignee:
-
Category:
Package System
Target version:
Start date:
02/17/2014
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:

Description

pkg parameter isn't encoded properly, it's possible to inject javascript code:

https://ip/pkg_mgr_install.php?mode=delete&pkg=%3C/script%3E%3Cscript%3Ealert(1)%3C/script%3E

Actions #1

Updated by Ermal Luçi over 7 years ago

  • Target version set to 2.1.1
  • Affected Version set to All
Actions #2

Updated by Ermal Luçi over 7 years ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100
Actions #3

Updated by Ermal Luçi over 7 years ago

Actions #4

Updated by Renato Botelho over 7 years ago

  • Status changed from Feedback to Resolved
Actions

Also available in: Atom PDF