Bug #23668: XSS in template analyzer - TYPO3 Core - TYPO3 Forge

Actions

Bug #23668

closed

Status:

Closed

Priority:

Should have

Assignee:

Category:

Target version:

Start date:

2010-10-04

Due date:

% Done:

Estimated time:

TYPO3 Version:

4.5

PHP Version:

5.2

Tags:

Complexity:

Is Regression:

Sprint Focus:

Description

Because of a missing htmlspecialchar() there is the possibiltiy of a XSS.

OTRS: 2010100110000031
Reporter: Susanne Moog
(issue imported from #M15887)

Files

Download all files

15887-template_analyzer-trunk.patch (831 Bytes) 15887-template_analyzer-trunk.patch		Administrator Admin, 2010-10-04 10:33
15887-template_analyzer-4_4.patch (849 Bytes) 15887-template_analyzer-4_4.patch		Administrator Admin, 2010-10-04 10:44
15887-template_analyzer-4_1.patch (1.05 KB) 15887-template_analyzer-4_1.patch		Administrator Admin, 2010-10-04 10:45

Actions

PoC: Name a template "<script>alert(123)</script>" and switch to the Template analyzer

Actions

Also available in: Atom PDF