View Issue Details

IDProjectCategoryView StatusLast Update
0011240mantisbtsecuritypublic2010-02-22 14:34
Reporterdhx Assigned Todhx  
PriorityurgentSeveritymajorReproducibilityalways
Status closedResolutionfixed 
Product Version1.2.0 
Target Version1.2.0Fixed in Version1.2.0 
Summary0011240: XSS on bug_revision_view_page.php with user Real Name field
Description

Set your real name in "My Account" to something including "<script>alert(42);</script>" and then go to bug_revision_view_page.php for a bug full text revision field that you've edited previously. You'll get a Javascript alert message indicating that an XSS vulnerability exists.

TagsNo tags attached.

Relationships

child of 0011234 closeddhx user_ensure_realname_valid() is not checked on account_page.php 

Activities

There are no notes attached to this issue.

Related Changesets

MantisBT: master-1.2.x 19409969

2009-12-01 01:16

dhx


Details Diff
Fix 0011240: XSS on bug_revision_view_page.php with user Real Name field

User real names aren't sanitised before display on
bug_revision_view_page.php thus this leads to an XSS vulnerability.
Affected Issues
0011240
mod - bug_revision_view_page.php Diff File

MantisBT: master 71ade607

2009-12-01 01:16

dhx


Details Diff
Fix 0011240: XSS on bug_revision_view_page.php with user Real Name field

User real names aren't sanitised before display on
bug_revision_view_page.php thus this leads to an XSS vulnerability.
Affected Issues
0011240
mod - bug_revision_view_page.php Diff File