User and admin self-exploit XSS issue

TeamMentor / Master

TEAM Mentor 3.x Released Code

16 stars 17 forks source link

User and admin self-exploit XSS issue #110

Open DinisCruz opened 11 years ago

DinisCruz commented 11 years ago

XSS issues on:

Signup screen - if the user puts a payload as the 'Username' value the payload will execute (use a ' to break into the script)
Rename View User action - where the user puts a payload as the renamed value (payload is only triggered on the moment right after the rename (when there is an animation to give the user a visual clue that the rename happened)
XmlDatabase_SetLibraryPath - on 'Control Panel' - 'Admin Tasks', submitted payloads on the 'Set Library Path' view will be triggered on the the 'View Config File' view
Set_Libraries_Zip_Folder - on 'Control Panel' - 'Admin Tasks', submitted payload on the 'Set Library Zip Path' view will be triggered on that view and on the the 'View Config File'

These are low risk since they require user intervention and cannot be triggered across users

arvinddoraiswamy commented 11 years ago

I would disagree on the XmlDatabase not being viewable across users. I think (not checked) any admin user who logs in will be affected as its persistent.

DinisCruz commented 11 years ago

At the moment only an admin can set those values up (and view those pages). and if they are Admin's there are a lot of other way to put a payload in TM (have you see the backend-editor? you can edit the entire TM Website from the browser :) )

btw, I'm not saying that these issues won't be fixed, just that they have low priority

arvinddoraiswamy commented 11 years ago

Oh that's fine...I just wanted to make sure I was clear about the problem.

Arvind

On Wed, Oct 17, 2012 at 6:10 PM, Dinis Cruz notifications@github.comwrote:

At the moment only an admin can set those values up (and view those pages). and if they are Admin's there are a lot of other way to put a payload in TM (have you see the backend-editor? you can edit the entire TM Website from the browser :) )

btw, I'm not saying that these issues won't be fixed, just that they have low priority

— Reply to this email directly or view it on GitHubhttps://github.com/TeamMentor/Master/issues/110#issuecomment-9550054.

romichg commented 11 years ago

I don't see this happening on the SignUp Screen anymore. Is this part fixed?

DinisCruz commented 9 years ago

we can close this