search

LavaLite / cms

Multilingual PHP CMS built with Laravel and bootstrap
https://lavalite.org
2.84k stars 966 forks source link

Demo site hacked #165

Open innerspirit opened 7 years ago

innerspirit commented 7 years ago

There's some kind of XSS vulnerability on the site. When I log in to the demo, I get redirected to a Stack Overflow page about XSS.

http://demo.lavalite.org/login?role=admin.web user: superuser@superuser.com pass: superuser@superuser.com

innerspirit commented 7 years ago

It seems that the problem is on a task, someone created a couple of them with html/scripts in them.

http://demo.lavalite.org/user/task/task has the redirect.

innerspirit commented 7 years ago

Looks like an unescaped output on the Task blade template, I can fix it myself if you give me a breakdown of how you install and work with all those subprojects split up like that.