aboutsummaryrefslogtreecommitdiffhomepage
path: root/tpl/includes.html
diff options
context:
space:
mode:
authorSebastien SAUVAGE <sebsauvage@sebsauvage.net>2013-03-03 22:15:38 +0100
committerSebastien SAUVAGE <sebsauvage@sebsauvage.net>2013-03-03 22:15:38 +0100
commitfeebc6d466ba78c5a34b4f6bbdfcce6a0785e709 (patch)
treeb2f31bf1ebc328f8845b496d88f827d742262ac4 /tpl/includes.html
parent705f8355a95c899c154ba08a159c2d4840fd8c98 (diff)
downloadShaarli-feebc6d466ba78c5a34b4f6bbdfcce6a0785e709.tar.gz
Shaarli-feebc6d466ba78c5a34b4f6bbdfcce6a0785e709.tar.zst
Shaarli-feebc6d466ba78c5a34b4f6bbdfcce6a0785e709.zip
Corrected vulnerabilities (see report below)
Title : Shaarli Vulnerabilities Author : @erwan_lr | @_WPScan_ Vendor : http://sebsauvage.net/wiki/doku.php?id=php:shaarli Download : https://github.com/sebsauvage/Shaarli/archive/master.zip | http://sebsauvage.net/files/shaarli_0.0.40beta.zip Affected versions : master-705F835, 0.0.40-beta (versions below may also be vulnerable) Vulnerabilities : Persistent XSS & Unvalidated Redirects and Forwards Persistent XSS : - During the instalation or configuration modification, the title field is vulnerable. e.g <script>alert(1)</script> Quotes can not be used because of var_export(), but String.fromCharCode works - The url field of a link is vulnerable : When there is no redirector : javascript:alert(1) Then, the code is triggered when a user click the url of a link Or with a classic XSS : "><script>alert(1)</script> Unvalidated Redirects and Forwards : A request with the param linksperpage or privateonly can be used to redirect a user to an arbitrary referer e.g GET /Audit/Shaarli/master-705f835/?linksperpage=10 HTTP/1.1 Host: 127.0.0.1 Referer: https://duckduckgo.com History : March 2, 2013 - Vendor contacted
Diffstat (limited to 'tpl/includes.html')
0 files changed, 0 insertions, 0 deletions