Bug 19100

Summary: XSS Flaws in memberentry.pl
Product: Koha Reporter: Amit Gupta <amitddng135>
Component: Architecture, internals, and plumbingAssignee: Amit Gupta <amitddng135>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: major    
Priority: P5 - low CC: amit.gupta, amitddng135, chris, fridolin.somers, jonathan.druart+koha, katrin.fischer, m.de.rooy, mtj, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 14568    
Attachments: Bug 19100 - XSS Flaws in memberentry.pl
Bug 19100 - XSS Flaws in memberentry.pl
[SIGNED-OFF] Bug 19100 - XSS Flaws in memberentry.pl
Bug 19100 - XSS Flaws in memberentry.pl

Description Amit Gupta 2017-08-14 17:32:31 UTC
XSS flaws in /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid
Comment 1 Amit Gupta 2017-08-14 17:38:26 UTC
Created attachment 65971 [details] [review]
Bug 19100 - XSS Flaws in memberentry.pl

1. Hit /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid
2. Notice the java script is executed.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid.
5. Notice it is no longer executed.
Comment 2 Amit Gupta 2017-08-15 17:54:45 UTC
Created attachment 66033 [details] [review]
Bug 19100 - XSS Flaws in memberentry.pl

1. Hit /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid
2. Notice the java script is executed.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid.
5. Notice it is no longer executed.

**************************
escaping from the template.
Comment 3 Mark Tompsett 2017-08-15 18:09:10 UTC
Created attachment 66035 [details] [review]
[SIGNED-OFF] Bug 19100 - XSS Flaws in memberentry.pl

1. Hit /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid
2. Notice the java script is executed.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid.
5. Notice it is no longer executed.

NOTE: I had to test in Microsoft Edge, because Chrome was blocking XSS for me.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 4 Marcel de Rooy 2017-08-16 11:29:29 UTC
Created attachment 66065 [details] [review]
Bug 19100 - XSS Flaws in memberentry.pl

1. Hit /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid
2. Notice the java script is executed.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid.
5. Notice it is no longer executed.

NOTE: I had to test in Microsoft Edge, because Chrome was blocking XSS for me.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 5 Jonathan Druart 2017-08-29 15:07:39 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 6 Fridolin Somers 2017-09-05 12:43:41 UTC
Pushed to 17.05.x, is in 17.05.03
Comment 7 Mason James 2017-09-20 02:41:03 UTC
Pushed to 16.05.x, for 16.05.16 release - thanks Amit :0)