bugphpGroupWare - Bugs: bug #13863, Main screen message allows for...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #13863: Main screen message allows for potential security risk

Submitted by:  None
Submitted on:  Wed 20 Jul 2005 02:36:25 PM UTC
 
Category:  API - Admin Item Group:  0.9.16.000 release
Severity:  3 - Normal Priority:  5 - Normal
Status:  Fixed Privacy:  Public
Assigned to:  skwashd Open/Closed:  Closed
Component Version:  None Operating System:  GNU/Linux - RedHat/Fedora
Reproducibility:  Every Time Planned Release:  0.9.16.011+
Fixed Release:  0.9.16.007
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       

 

Thu 21 Jul 2005 01:07:31 AM UTC, comment #1: 

This is a low risk exploit as admin privledges are required.  Will fix it soon.

Next time please email -email is unavailable- as mentioned on our website.

Dave Hall <skwashd>
Project Administrator
Wed 20 Jul 2005 02:36:25 PM UTC, original submission:  

When editing the main screen message from the admin pages, it appears to be possible to include any HTML that you like, which means that this could potentially be abused, either with javascript or other code embedded in the message.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

 

 

 

 

Follow 8 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2005-08-24 skwashd CategoryNone => API - Admin
    StatusNone => Fixed
    PrivacyPrivate => Public
    Open/ClosedOpen => Closed
    Planned ReleaseNone => 0.9.16.011+
    Fixed Release => 0.9.16.007
2005-07-21 skwashd Assigned toNone => skwashd
2005-07-21 skwashd PrivacyPublic => Private

Back to the top


Powered by Savane 3.9