73a66ccaf4
1. Hit /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
xx - is a guarantorid
2. Notice the java script is executed.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/memberentry.pl?op=add&guarantorid=xx<script>alert('amit')</script>
xx - is a guarantorid.
5. Notice it is no longer executed.
NOTE: I had to test in Microsoft Edge, because Chrome was blocking XSS for me.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
|
||
|---|---|---|
| .. | ||
| tables | ||
| boraccount.tt | ||
| deletemem.tt | ||
| discharge.tt | ||
| discharges.tt | ||
| files.tt | ||
| housebound.tt | ||
| mancredit.tt | ||
| maninvoice.tt | ||
| member-flags.tt | ||
| member-password.tt | ||
| member.tt | ||
| memberentrygen.tt | ||
| members-update.tt | ||
| moremember-brief.tt | ||
| moremember-print.tt | ||
| moremember-receipt.tt | ||
| moremember.tt | ||
| nl-search.tt | ||
| notices.tt | ||
| pay.tt | ||
| paycollect.tt | ||
| printfeercpt.tt | ||
| printinvoice.tt | ||
| purchase-suggestions.tt | ||
| readingrec.tt | ||
| routing-lists.tt | ||
| statistics.tt | ||
| update-child.tt | ||