Bug 19100 - XSS Flaws in memberentry.pl
Summary: XSS Flaws in memberentry.pl
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Amit Gupta
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks: 14568
  Show dependency treegraph
 
Reported: 2017-08-14 17:32 UTC by Amit Gupta
Modified: 2019-10-14 19:58 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 19100 - XSS Flaws in memberentry.pl (1.34 KB, patch)
2017-08-14 17:38 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19100 - XSS Flaws in memberentry.pl (1.56 KB, patch)
2017-08-15 17:54 UTC, Amit Gupta
Details | Diff | Splinter Review
[SIGNED-OFF] Bug 19100 - XSS Flaws in memberentry.pl (1.71 KB, patch)
2017-08-15 18:09 UTC, Mark Tompsett
Details | Diff | Splinter Review
Bug 19100 - XSS Flaws in memberentry.pl (1.80 KB, patch)
2017-08-16 11:29 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Amit Gupta 2017-08-14 17:32:31 UTC
XSS flaws in /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid
Comment 1 Amit Gupta 2017-08-14 17:38:26 UTC
Created attachment 65971 [details] [review]
Bug 19100 - XSS Flaws in memberentry.pl

1. Hit /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid
2. Notice the java script is executed.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid.
5. Notice it is no longer executed.
Comment 2 Amit Gupta 2017-08-15 17:54:45 UTC
Created attachment 66033 [details] [review]
Bug 19100 - XSS Flaws in memberentry.pl

1. Hit /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid
2. Notice the java script is executed.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid.
5. Notice it is no longer executed.

**************************
escaping from the template.
Comment 3 Mark Tompsett 2017-08-15 18:09:10 UTC
Created attachment 66035 [details] [review]
[SIGNED-OFF] Bug 19100 - XSS Flaws in memberentry.pl

1. Hit /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid
2. Notice the java script is executed.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid.
5. Notice it is no longer executed.

NOTE: I had to test in Microsoft Edge, because Chrome was blocking XSS for me.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 4 Marcel de Rooy 2017-08-16 11:29:29 UTC
Created attachment 66065 [details] [review]
Bug 19100 - XSS Flaws in memberentry.pl

1. Hit /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid
2. Notice the java script is executed.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
   xx - is a guarantorid.
5. Notice it is no longer executed.

NOTE: I had to test in Microsoft Edge, because Chrome was blocking XSS for me.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 5 Jonathan Druart 2017-08-29 15:07:39 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 6 Fridolin Somers 2017-09-05 12:43:41 UTC
Pushed to 17.05.x, is in 17.05.03
Comment 7 Mason James 2017-09-20 02:41:03 UTC
Pushed to 16.05.x, for 16.05.16 release - thanks Amit :0)