Информационная безопасность
[RU] switch to English

Дополнительная информация

  Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  Event Easy Calendar 1.0.0 WP plugin

  [SECURITY] [DSA 2752-1] phpbb3 security update

  Cross-Site Scripting (XSS) in WikkaWiki

  [iBliss Security Advisory] Cross-Site Scripting (XSS) vulnerability in Design-approval-
system wordpress plugin

From:Richard Clifford <darkmantis_(at)_cybershade.org>
Date:3 октября 2013 г.
Subject:ExpressionEngine 2.6 Persistent XSS


I'd like to disclose a vulnerability I found in ExpressionEngine 2.6 and below.

The issue is when you submit a new entry through Admin -> Content -> Publish and you are using the RTE, if you enter HTML into that editor, the next page will execute the HTML, which it shouldn’t. The RTE should htmlentities all input data that goes in (when you’re not in the ‘source-view’), thus creating a HTML-Safe preview page.

The payload I used was </title><script>alert(document.domain);</script> which got executed on the view_entry.php view (system -> expressionengine -> views -> content -> view_entry.php)

The reply that I got from the developers was:

In system/expressionengine/controllers/cp/content_publish.php look at line 685:
$r .= ee()->api_channel_fields->apply('replace_tag', array('data' => $data));

And replace it with this:
$r .= ee()->api_channel_fields->apply('replace_tag', array('data' => htmlentities($data)));

As you can see at: https://support.ellislab.com/bugs/detail/19715

Best Regards,
Richard Clifford.

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород