Actions
Bug #19935
closed
XSS in the User Admin
Start date:
2009-01-29
Due date:
% Done:
0%
Estimated time:
TYPO3 Version:
4.1
PHP Version:
4.3
Tags:
Complexity:
Is Regression:
Sprint Focus:
Description
Try setting username to `something<script>alert('hi!')</script>` (without backticks) and navigate to the "User Admin". You'll get an alert. Seems like user name is not htmlspecialchar'ed and external script can be executed inside the TYPO3 BE. List module shows bad user name but User Admin is not.
(issue imported from #M10298)
Files
Updated by Steffen Kamper almost 16 years ago
Hi,
you could commit this one with a cleaning patch adding spaces and CGL ?
I did same once with felogin.
Updated by Michael Stucki almost 16 years ago
@Steffen: Don't know what you're referring to, but I assume it has low priority and can be done later.
Updated by Michael Stucki almost 16 years ago
Attached is a new version for TYPO3 4.0, 4.1, 4.2 and Trunk (2009-02-09).
Updated by Michael Stucki almost 16 years ago
Fixed in versions 4.0.12, 4.1.10, 4.2.6.
Actions