Security: Stored Cross Site Scripting for static QR code

giandonatoinverso / PHP-Dynamic-Qr-code

PHP Dynamic Qr code is a script that allows the generation and saving of dynamic and static QR codes

MIT License

243 stars 73 forks source link

Security: Stored Cross Site Scripting for static QR code #93

Closed tranmh closed 4 months ago

tranmh commented 4 months ago

It is possible to at creation time of static QR code to insert the following string for Filename and Text: <img src/onerror=prompt(8)> and <img src/onerror=prompt(11)>

Doing, it is proven that it is possible do XSS to other users being on the same system, if revisiting the system: https://giandonatoinverso.it/qrcode/static_qrcodes.php

I hope you have an idea how to fix it.

Thx.

giandonatoinverso commented 4 months ago

I think the inputs need to be filtered. Some already are. I currently don't have time to work on the project, I invite the community to do so

tranmh commented 4 months ago

PR #94 is merged. So closing.