Skip to content

XSS spotted #18

@BaronnetNoir

Description

@BaronnetNoir

Hey to every people who want to use this project, and to creator (great project)

I spotted some XSS on the Data Result, not a big vuln because it's pretty rare to have that type of username, but should be fixed. It happend when the database contains some code that can be executed.

Vulnerability Preview

image

How to fix ?

Simply use htmlspecialchars() or htmlentities() on the result variable $value like below.

xss

This fix is the simplest, i also suggest to block any special characters in the search field.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions