Attachment 65965 Details for Bug 19086 – Bug 19086 Stored XSS in routing-lists.pl

[patch] Bug 19086 Stored XSS in routing-lists.pl

0001-Bug-19086-Stored-XSS-in-routing-lists.pl.patch (text/plain), 1.24 KB, created by Amit Gupta on 2017-08-14 16:54:00 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Amit Gupta

Created: 2017-08-14 16:54:00 UTC

Size: 1.24 KB

patch

obsolete

>From bda623a9c724a5fb9a98ebb0c066c7c61ac68388 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Mon, 14 Aug 2017 22:16:21 +0530
>Subject: [PATCH] Bug 19086 Stored XSS in routing-lists.pl
>
>1. Hit /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
>   xx is a borrowernumber
>2. Notice java script is execute.
>3. Apply patch.
>3. Reload page, and hit the page again /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
>   xx is a borrowernumber
>4. Notice it is no longer executed.
>---
> members/routing-lists.pl |    2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/members/routing-lists.pl b/members/routing-lists.pl
>index 6b024bd..9e65104 100755
>--- a/members/routing-lists.pl
>+++ b/members/routing-lists.pl
>@@ -20,6 +20,7 @@
> use strict;
> #use warnings; FIXME - Bug 2505
> use CGI qw ( -utf8 );
>+use HTML::Entities;
> use C4::Output;
> use C4::Auth qw/:DEFAULT/;
> use C4::Members;
>@@ -45,6 +46,7 @@ my $findborrower = $query->param('findborrower');
> $findborrower =~ s|,| |g;
> 
> my $borrowernumber = $query->param('borrowernumber');
>+$borrowernumber = HTML::Entities::encode($borrowernumber);
> 
> my $branch = C4::Context->userenv->{'branch'};
> 
>-- 
>1.7.9.5
>

Actions: View | Diff | Splinter Review

Attachments on bug 19086: 65927 | 65929 | 65958 | 65960 | 65965 | 65966 | 65967 | 65968 | 65969 | 65970 | 65972 | 65984 | 65985 | 65986 | 65987 | 66058 | 66059 | 66060 | 66061 | 66062 | 66063 | 66433 | 66434 | 66435 | 66436 | 66437 | 66438