Cross-site scripting vulnerability

[fgeek]

Hello,

Cross-site scripting vulnerability has been announced in full disclosure mailing list.

According to this Curesec advisory timeline they were unable to contact you:

11/17/2015 Informed Vendor about Issue (no reply)
12/10/2015 Reminded Vendor of Disclosure Date (no reply)
12/21/2015 Disclosed to public

Issue can be reproduced with following URL:

http://localhost/esoTalk-1.0.0g4/conversations/a'";><img src=no onerror=alert(1)>?search=test

Do you have plans to fix this security vulnerability? If you do not plan to fix vulnerabilities in esoTalk please mention it in the README or similar, thank you. As far as I can tell this issue does not yet have CVE identifier assigned. Have you request it?

[tobyzerner]

Thanks for reporting this. I never got an email... my @esotalk.org address might be broken, I'll look into it.

[fgeek]

CVE request: http://www.openwall.com/lists/oss-security/2016/01/03/1

[inliquid]

What should I do to reproduce this?
Tried on my 1.0.0g4 - doesn't work
http://localhost/esoTalk-1.0.0g4/conversations/a'";><img src=no onerror=alert(1)>?search=test

[inliquid]

Sorry guys but I can't understand and reproduce the case you were fixing. Anyways - I have applied these changes.

However, I found another XSS bug (with the above commit in place).

[fgeek]

Good that you found more issues. @tobscure can you fix that one too?

I was also planning to perform security testing for esoTalk codebase when I have spare time in near future.

[wkhayrattee]

@fgeek thanks for all your good intentions
@tobscure thank you for still looking into this..

A quick question btw for @tobscure

• Did you use nested set model or adjacency model with the hierarchical data for esoTalk?
  (Sorry I tried emailing you as well, but in vain)

[inliquid]

This should help develop...inliquid:patch-1

[tobyzerner]

Thanks @inliquid

[tobyzerner]

@7php nested set model

[wkhayrattee]

awesome, thanks @tobscure !

[fgeek]

Tried on my 1.0.0g4 - doesn't work

@inliquid I was able to reproduce this cross-site scripting vulnerability without problems e.g. when using logged in administrator account.

[inliquid]

@fgeek maybe it wasn't working because of some of my plugins.

[fgeek]

@tobscure I have sent email to your Gmail address in your GitHub profile. Did you receive it?

[fgeek]

MITRE assigned CVE-2015-9285 for this issue.