Bug 19102

Summary: XSS Flaws in circulation.pl - routing-lists.pl - readingrec.pl - notices.pl - maninvoice.pl - boraccount.pl - mancredit.pl
Product: Koha Reporter: Amit Gupta <amitddng135>
Component: Architecture, internals, and plumbingAssignee: Amit Gupta <amitddng135>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: amitddng135, chris, jonathan.druart, katrin.fischer, kyle, m.de.rooy, nick, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 14568    
Attachments: Bug 19102 - XSS Flaws in circulation.pl
Bug 19086 Fix XSS in routing-lists.pl
Bug 19086 Fix XSS in readingrec.pl
Bug 19102 Fix XSS in routing-lists.pl
Bug 19102 Fix XSS in readingrec.pl
Bug 19102 Fix XSS in notices.pl
Bug 19102 Fix XSS in maninvoice.pl
Bug 19102 Fix XSS in boraccount.pl
Bug 19102 Fix XSS in mancredit.pl
[SIGNED OFF] Bug 19102 - XSS Flaws in circulation.pl
[SIGNED OFF] Bug 19102 Fix XSS in routing-lists.pl
[SIGNED OFF] Bug 19102 Fix XSS in readingrec.pl
[SIGNED OFF] Bug 19102 Fix XSS in notices.pl
[SIGNED OFF] Bug 19102 Fix XSS in maninvoice.pl
[SIGNED OFF] Bug 19102 Fix XSS in boraccount.pl
[SIGNED OFF] Bug 19102 Fix XSS in mancredit.pl

Description Amit Gupta 2017-08-14 19:28:52 UTC
XSS Flaws in circulation.pl - routing-lists.pl - readingrec.pl - notices.pl - maninvoice.pl - boraccount.pl - mancredit.pl
Comment 1 Amit Gupta 2017-08-14 19:44:59 UTC
Created attachment 65975 [details] [review]
Bug 19102 - XSS Flaws in circulation.pl

1. Hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber.
6. Notice it is no longer executed.
Comment 2 Amit Gupta 2017-08-14 19:51:12 UTC
Created attachment 65976 [details] [review]
Bug 19086 Fix XSS in routing-lists.pl

1. Hit /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 3 Amit Gupta 2017-08-14 19:53:20 UTC
Created attachment 65977 [details] [review]
Bug 19086 Fix XSS in readingrec.pl

1. Hit /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 4 Amit Gupta 2017-08-14 19:57:36 UTC
Created attachment 65978 [details] [review]
Bug 19102 Fix XSS in routing-lists.pl

1. Hit /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 5 Amit Gupta 2017-08-14 19:59:01 UTC
Created attachment 65979 [details] [review]
Bug 19102 Fix XSS in readingrec.pl

1. Hit /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 6 Amit Gupta 2017-08-14 20:00:58 UTC
Created attachment 65980 [details] [review]
Bug 19102 Fix XSS in notices.pl

1. Hit /cgi-bin/koha/members/notices.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/notices.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 7 Amit Gupta 2017-08-14 20:03:57 UTC
Created attachment 65981 [details] [review]
Bug 19102 Fix XSS in maninvoice.pl

1. Hit /cgi-bin/koha/members/maninvoice.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/maninvoice.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 8 Amit Gupta 2017-08-14 20:06:36 UTC
Created attachment 65982 [details] [review]
Bug 19102 Fix XSS in boraccount.pl

1. Hit /cgi-bin/koha/members/boraccount.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/boraccount.pl?borrowernumber=xx<script>alert('amity')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 9 Amit Gupta 2017-08-14 20:08:58 UTC
Created attachment 65983 [details] [review]
Bug 19102 Fix XSS in mancredit.pl

1. Hit /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 10 Katrin Fischer 2017-08-16 11:36:07 UTC
Created attachment 66069 [details] [review]
[SIGNED OFF] Bug 19102 - XSS Flaws in circulation.pl

1. Hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber.
6. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 11 Katrin Fischer 2017-08-16 11:36:10 UTC
Created attachment 66070 [details] [review]
[SIGNED OFF] Bug 19102 Fix XSS in routing-lists.pl

1. Hit /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 12 Katrin Fischer 2017-08-16 11:36:13 UTC
Created attachment 66071 [details] [review]
[SIGNED OFF] Bug 19102 Fix XSS in readingrec.pl

1. Hit /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 13 Katrin Fischer 2017-08-16 11:36:17 UTC
Created attachment 66072 [details] [review]
[SIGNED OFF] Bug 19102 Fix XSS in notices.pl

1. Hit /cgi-bin/koha/members/notices.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/notices.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 14 Katrin Fischer 2017-08-16 11:36:20 UTC
Created attachment 66073 [details] [review]
[SIGNED OFF] Bug 19102 Fix XSS in maninvoice.pl

1. Hit /cgi-bin/koha/members/maninvoice.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/maninvoice.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 15 Katrin Fischer 2017-08-16 11:36:23 UTC
Created attachment 66074 [details] [review]
[SIGNED OFF] Bug 19102 Fix XSS in boraccount.pl

1. Hit /cgi-bin/koha/members/boraccount.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/boraccount.pl?borrowernumber=xx<script>alert('amity')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 16 Katrin Fischer 2017-08-16 11:36:26 UTC
Created attachment 66075 [details] [review]
[SIGNED OFF] Bug 19102 Fix XSS in mancredit.pl

1. Hit /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx<script>alert('amit')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 17 Marcel de Rooy 2017-08-25 06:18:04 UTC
Why are we doing it here with HTML::Entities and are we editing templates on the other reports ?

Needs feedback
Comment 18 Jonathan Druart 2019-03-15 22:59:37 UTC
This has been solved by or prior bug 13618.