Attachment 65966 Details for Bug 19086 – Bug 19086 Stored XSS in readingrec.pl

[patch] Bug 19086 Stored XSS in readingrec.pl

0001-Bug-19086-Stored-XSS-in-readingrec.pl.patch (text/plain), 1.39 KB, created by Amit Gupta on 2017-08-14 16:59:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Amit Gupta

Created: 2017-08-14 16:59:25 UTC

Size: 1.39 KB

patch

obsolete

>From e84be049dbe04f5776dd8671013834a2a6913115 Mon Sep 17 00:00:00 2001
>From: Amit Gupta <amit.gupta@informaticsglobal.com>
>Date: Mon, 14 Aug 2017 22:27:03 +0530
>Subject: [PATCH] Bug 19086 Stored XSS in readingrec.pl
>
>1. Hit /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
>   xx is a borrowernumber
>2. Notice java script is execute.
>3. Apply patch.
>4. Reload page, and hit the page again /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
>   xx is a borrowernumber
>5. Notice it is no longer executed.
>---
> members/readingrec.pl |    4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/members/readingrec.pl b/members/readingrec.pl
>index b0b563c..5a26851 100755
>--- a/members/readingrec.pl
>+++ b/members/readingrec.pl
>@@ -24,7 +24,7 @@ use strict;
> use warnings;
> 
> use CGI qw ( -utf8 );
>-
>+use HTML::Entities;
> use C4::Auth;
> use C4::Output;
> use C4::Members;
>@@ -59,7 +59,7 @@ if ($input->param('cardnumber')) {
>     $borrowernumber = $data->{'borrowernumber'}; # we must define this as it is used to retrieve other data about the patron
> }
> if ($input->param('borrowernumber')) {
>-    $borrowernumber = $input->param('borrowernumber');
>+    $borrowernumber = HTML::Entities::encode($input->param('borrowernumber'));
>     $patron = Koha::Patrons->find( $borrowernumber );
>     $data = $patron->unblessed;
> }
>-- 
>1.7.9.5
>

Actions: View | Diff | Splinter Review

Attachments on bug 19086: 65927 | 65929 | 65958 | 65960 | 65965 | 65966 | 65967 | 65968 | 65969 | 65970 | 65972 | 65984 | 65985 | 65986 | 65987 | 66058 | 66059 | 66060 | 66061 | 66062 | 66063 | 66433 | 66434 | 66435 | 66436 | 66437 | 66438