bugGnuheter - Bugs: bug #2890, docs.php XSS

 
 

bug #2890: docs.php XSS

Submitter:  Invalid User ID <#5588>
Submitted:  Fri 21 Mar 2003 11:55:50 AM UTC
   
 
Category:  Bug Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 03 Apr 2003 11:45:14 AM UTC, comment #1: 

Den har ar val lagad nu?

Invalid User ID <#5588>
Fri 21 Mar 2003 11:55:50 AM UTC, original submission:  

docs.php har ett Cross-Site Scripting-problem. Begrunda följande URL:

http://gnuheter.org/docs.php?config=1&sitename=%3cscript%3ealert%2857%29%3c%2fscript%3e

Det fixas enkelt genom att ändra if (!config) include.. till bara include.

Invalid User ID <#5588>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

 

No changes have been made to this item

Back to the top

Powered by Savane 3.13-f8d8.
Corresponding source code