From bugzilla-daemon@bugs.koha-community.org Mon Jul 20 11:31:45 2015
From: bugzilla-daemon@bugs.koha-community.org
To: koha-bugs@lists.koha-community.org
Subject: [Koha-bugs] [Bug 14568] New: XSS in Staff Client
Date: Mon, 20 Jul 2015 09:31:42 +0000
Message-ID: <bug-14568-70@http.bugs.koha-community.org/bugzilla3/>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0834529216747242121=="

--===============0834529216747242121==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3D14568

            Bug ID: 14568
           Summary: XSS in Staff Client
 Change sponsored?: ---
           Product: Koha
           Version: master
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5 - low
         Component: Staff Client
          Assignee: koha-bugs@lists.koha-community.org
          Reporter: larit@student.uef.fi
        QA Contact: testopia@bugs.koha-community.org
                CC: gmcharlt@gmail.com

Cross site scripting vulnerabilities found in Staff Client

detail.pl - param biblionumber
cgi-bin/koha/catalogue/detail.pl?biblionumber=3D1<script
type=3D"text/javascript">alert("hello")</script>

ISBDdetail.pl - param biblionumber
cgi-bin/koha/catalogue/ISBDdetail.pl?biblionumber=3D1<script
type=3D"text/javascript">alert("hello")</script>

MARCdetail.pl - param biblionumber
cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=3D1<script
type=3D"text/javascript">alert("hello")</script>

moredetail.pl - param biblionumber
cgi-bin/koha/catalogue/moredetail.pl?biblionumber=3D1<script
type=3D"text/javascript">alert("hello")</script>

request.pl - param biblionumber
cgi-bin/koha/reserve/request.pl?biblionumber=3D1"><script
type=3D"text/javascript">alert("hello")</script>

viewlog.pl - param object
cgi-bin/koha/tools/viewlog.pl?do_it=3D1&modules=3DCATALOGUING&action=3DMODIFY=
&object=3D462688<script
type=3D"text/javascript">alert("hello")</script>

--=20
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.

--===============0834529216747242121==--