aboutsummaryrefslogtreecommitdiffhomepage
path: root/tpl/page.header.html
diff options
context:
space:
mode:
authorSebastien SAUVAGE <sebsauvage@sebsauvage.net>2013-03-03 22:15:38 +0100
committerSebastien SAUVAGE <sebsauvage@sebsauvage.net>2013-03-03 22:15:38 +0100
commitfeebc6d466ba78c5a34b4f6bbdfcce6a0785e709 (patch)
treeb2f31bf1ebc328f8845b496d88f827d742262ac4 /tpl/page.header.html
parent705f8355a95c899c154ba08a159c2d4840fd8c98 (diff)
downloadShaarli-feebc6d466ba78c5a34b4f6bbdfcce6a0785e709.tar.gz
Shaarli-feebc6d466ba78c5a34b4f6bbdfcce6a0785e709.tar.zst
Shaarli-feebc6d466ba78c5a34b4f6bbdfcce6a0785e709.zip
Corrected vulnerabilities (see report below)
Title : Shaarli Vulnerabilities Author : @erwan_lr | @_WPScan_ Vendor : http://sebsauvage.net/wiki/doku.php?id=php:shaarli Download : https://github.com/sebsauvage/Shaarli/archive/master.zip | http://sebsauvage.net/files/shaarli_0.0.40beta.zip Affected versions : master-705F835, 0.0.40-beta (versions below may also be vulnerable) Vulnerabilities : Persistent XSS & Unvalidated Redirects and Forwards Persistent XSS : - During the instalation or configuration modification, the title field is vulnerable. e.g <script>alert(1)</script> Quotes can not be used because of var_export(), but String.fromCharCode works - The url field of a link is vulnerable : When there is no redirector : javascript:alert(1) Then, the code is triggered when a user click the url of a link Or with a classic XSS : "><script>alert(1)</script> Unvalidated Redirects and Forwards : A request with the param linksperpage or privateonly can be used to redirect a user to an arbitrary referer e.g GET /Audit/Shaarli/master-705f835/?linksperpage=10 HTTP/1.1 Host: 127.0.0.1 Referer: https://duckduckgo.com History : March 2, 2013 - Vendor contacted
Diffstat (limited to 'tpl/page.header.html')
-rw-r--r--tpl/page.header.html2
1 files changed, 1 insertions, 1 deletions
diff --git a/tpl/page.header.html b/tpl/page.header.html
index 60fc1767..125b365b 100644
--- a/tpl/page.header.html
+++ b/tpl/page.header.html
@@ -2,7 +2,7 @@
2 <div id="logo" title="Share your links !" onclick="document.location='?';"></div> 2 <div id="logo" title="Share your links !" onclick="document.location='?';"></div>
3 <div style="float:right; font-style:italic; color:#bbb; text-align:right; padding:0 5 0 0;" class="nomobile">Shaare your links...<br> 3 <div style="float:right; font-style:italic; color:#bbb; text-align:right; padding:0 5 0 0;" class="nomobile">Shaare your links...<br>
4 {if="!empty($linkcount)"}{$linkcount} links{/if}</div> 4 {if="!empty($linkcount)"}{$linkcount} links{/if}</div>
5 <span id="shaarli_title"><a href="?">{$shaarlititle}</a></span> 5 <span id="shaarli_title"><a href="?">{$shaarlititle|htmlspecialchars}</a></span>
6 6
7{if="!empty($_GET['source']) && $_GET['source']=='bookmarklet'"} 7{if="!empty($_GET['source']) && $_GET['source']=='bookmarklet'"}
8 {ignore} When called as a popup from bookmarklet, do not display menu. {/ignore} 8 {ignore} When called as a popup from bookmarklet, do not display menu. {/ignore}