New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

This editor is not fully filtered, causing XSS vulnerabilities #612

Open

hackd0g opened this issue Aug 16, 2018 · 1 comment

hackd0g commented Aug 16, 2018

when We enter some strings,such as:
</textarea><img/id="confirm(/xss/)"/alt="/"src="/"onerror=eval(id)>'">
The editor will execute XSS payload

When some cms use this editor, it is easy to get administrator rights by using XSS attack.

NicoleG25 commented Dec 26, 2019

Was this issue fixed ? @pandao
CVE-2018-16330 was assigned.

alromh87 added a commit to alromh87/editor.md that referenced this issue


          Improve RegExp filter

f5cb82c

fixes #pandao#612
fixes #pandao#662
fixes #pandao#697
fixes #pandao#700
fixes #pandao#701
fixes #pandao#709
fixes #pandao#715
fixes #pandao#764
fixes #pandao#816

### Probably:
fixes #pandao#307
fixes #pandao#560

alromh87 added a commit to alromh87/editor.md that referenced this issue


          Improve RegExp filter

067619e

fixes #pandao#612
fixes #pandao#662
fixes #pandao#697
fixes #pandao#700
fixes #pandao#701
fixes #pandao#709
fixes #pandao#715
fixes #pandao#764
fixes #pandao#816

fixes #pandao#307
fixes #pandao#560

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment