Stored XSS in lib/functions.php:1519

[scarvell]

Lower risk, given that an account requires access to be able to add/edit external links to store the XSS, but line 1519 of lib/html.php isn't sanitizing $tab['title'].

print "<li><a id='" . (isset($tab['id']) ? $tab['id'] : 'maintab-anchor-' . $i) . "' class='lefttab" .(isset($tab['selected']) ? ' selected':'') . "' href='" . $tab['url'] . "'>" . $tab['title'] . "</a></li>\n";

Although the title field in external_links is a varchar(20), we can get around that restriction by creating multiple tabs and using comment blocks to keep the XSS valid:

Create the first tab with title:
<script>alert(1)/*

Create second tab with title:
*/</script>

Tested against version 1.1.17

[cigamit]

Agree, but we will fix it anyway.

[cigamit]

Resolved.

[fgeek]

Please use CVE-2017-12978 for this issue.