Project

General

Profile

Actions

Bug #7650

closed

vendor/filebrowser/browser.php: Filename parameter is unencoded which can lead to a potential XSS

Added by Jim Pingle over 7 years ago. Updated about 7 years ago.

Status:
Resolved
Priority:
High
Assignee:
Category:
Web Interface
Target version:
Start date:
06/16/2017
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:
All

Description

First load a file on diag_edit.php and then save it with ');alert('XSS appended to the name, then browse and try to load the file.

In order to exploit this, the user must already have root access to the box to write a file, or write it themselves. There is no practical way to exploit this that would gain an attacker anything they couldn't get by other means with access to this page already. Still worth addressing.

Actions

Also available in: Atom PDF