search

Project-Pier / ProjectPier-Core

ProjectPier is a Free, Open-Source, PHP application for managing tasks, projects and teams through an intuitive web interface.
http://www.projectpier.org
GNU Affero General Public License v3.0
37 stars 16 forks source link

Security Issue - XSS - CVE-2015-2796 #37

Closed jaydipdave closed 9 years ago

jaydipdave commented 9 years ago

An attacker can pass this URL (with XSS payload) to a victim (user of ProjectPier) and can make the victim to perform some tasks or can infect the user. The vulnerability is XSS

http://www.prop.com/public/index.php?c=project&a=search&active_project=1&search_for=%3Cscript%3Ealert%28420%29%3B%3C%2Fscript%3E

The search_for parameter is not getting sanitized. You can use CVE-2015-2796 cve-id in your announcements when you fix this vulnerability.

Thanks, Jaydeep

JonDeG commented 9 years ago

Acknowledging receipt, thanks for reporting. Reporting it privately would have been appreciated.

JonDeG commented 9 years ago

Proposed fix committed, would appreciate someone verifying ASAP.

jaydipdave commented 9 years ago

Extremely sorry, I searched for "Private Message" option on github, but couldn't find it. So posted here.

I am verifying it now.

jaydipdave commented 9 years ago

Verified. Issue is fixed.

Thanks.

JonDeG commented 9 years ago

No problem, it is mitigated by the fact that the user has to be logged in and it turned out to be an easy fix. Also, did you also post this: https://github.com/Project-Pier/ProjectPier-Core/issues/29 ? That person never got back to me and I was wondering if it was the same issue. Thx.

jaydipdave commented 9 years ago

Nope, I didn't post #29. May be the same issue. By the way, I audited Project Pier for SQL and XSS but couldn't find anything other than this.

On Thu, Apr 2, 2015 at 8:10 PM, JonDeG notifications@github.com wrote:

No problem, it is mitigated by the fact that the user has to be logged in and it turned out to be an easy fix. Also, did you also post this: #29 https://github.com/Project-Pier/ProjectPier-Core/issues/29 ? That person never got back to me and I was wondering if it was the same issue. Thx.

— Reply to this email directly or view it on GitHub https://github.com/Project-Pier/ProjectPier-Core/issues/37#issuecomment-89088135 .