Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

admin/profile.php At xss #1234

Closed
wangai666 opened this issue Jun 28, 2017 · 5 comments
Closed

admin/profile.php At xss #1234

wangai666 opened this issue Jun 28, 2017 · 5 comments
Labels
Bug DEV SECURITY
Milestone
3.4.0

Comments

@wangai666
Copy link

wangai666 commented Jun 28, 2017 •
edited

Display Name: where there is xss
payload: "><script>alert(/xss/)</script>
@fgeek
Copy link

fgeek commented Jul 1, 2017 •
edited

CVE-2017-10673 has been assigned for this issue. Please use it in the commit message and ChangeLog, thanks.

@tablatronix
Copy link
Member

This has not been verified, nor reproduced in 3.3.x

@wangai666
Copy link
Author

in GetSimpleCMS - 3.4.0a

@tablatronix
Copy link
Member

tablatronix commented Jul 1, 2017 •
edited

Thanks

Yes known issue in DEV branch, settings.php xss fixed were not merged into new profile.php and have to be manually repatched. profile.php does not exist in stable.

There is no current dev release for master branch, CVE in invalid for stable.

#797

  • reapply basic xss filtering on profile.php

@tablatronix tablatronix added the DEV label Jul 1, 2017
@tablatronix tablatronix added this to the 3.4.0 milestone Jul 1, 2017
@wangai666
Copy link
Author

blunt，Hope to learn more with you!

@tablatronix tablatronix added this to Dev Bugs in 3.4 Release Tasks Dec 23, 2017
@tablatronix tablatronix removed this from Dev Outstanding in 3.4 Release Tasks Dec 23, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug DEV SECURITY
Projects
None yet
Milestone
3.4.0
Development

No branches or pull requests
3 participants
@fgeek @tablatronix @wangai666