Bug #3461: XSS - package system - pfSense - pfSense bugtracker

Actions

Bug #3461

closed

XSS - package system

Added by Fernando Munoz about 10 years ago. Updated about 10 years ago.

Status:

Resolved

Priority:

High

Assignee:

-

Category:

Package System

Target version:

Start date:

02/17/2014

Due date:

% Done:

100%

Estimated time:

Plus Target Version:

Release Notes:

Affected Version:

All

Affected Architecture:

Description

pkg parameter isn't encoded properly, it's possible to inject javascript code:

https://ip/pkg_mgr_install.php?mode=delete&pkg=%3C/script%3E%3Cscript%3Ealert(1)%3C/script%3E

Actions

Also available in: Atom PDF