[Bug 3759] New: XSS Exploit in Search Results.
http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3759 Summary: XSS Exploit in Search Results. Product: Koha Version: unspecified Platform: All OS/Version: All Status: NEW Severity: major Priority: P5 Component: Searching AssignedTo: jmf@liblime.com ReportedBy: sirusdv@pwnzord.com Estimated Hours: 0.0 Change sponsored?: --- Example: /cgi-bin/koha/opac-search.pl?q=<script>alert('meow')<%2Fscript> Dangers: http://cwe.mitre.org/data/definitions/79.html Fix for 'en' attached. Should be changed in others as well. -- Configure bugmail: http://bugs.koha.org/cgi-bin/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3759 Mikhail Davidov <sirusdv@pwnzord.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sirusdv@pwnzord.com -- Configure bugmail: http://bugs.koha.org/cgi-bin/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3759 --- Comment #1 from Mikhail Davidov <sirusdv@pwnzord.com> 2009-11-03 22:46:34 --- Created an attachment (id=1235) --> (http://bugs.koha.org/cgi-bin/bugzilla3/attachment.cgi?id=1235) .diff of ./htdocs/opac-tmpl/prog/en/includes/masthead.inc -- Configure bugmail: http://bugs.koha.org/cgi-bin/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3759 MJR <mjr@ttllp.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mjr@ttllp.co.uk Status|NEW |RESOLVED Resolution| |DUPLICATE --- Comment #2 from MJR <mjr@ttllp.co.uk> 2009-11-04 22:53:28 --- This is only a fix for one instance. I think a general fix is needed, probably by changing the default escape to HTML. *** This bug has been marked as a duplicate of bug 3652 *** -- Configure bugmail: http://bugs.koha.org/cgi-bin/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠kohaorg.ec2.liblime.com