:shield: Security vulnerabilities

jan-vandenberg / cruddiy

No-code Bootstrap PHP CRUD generator

http://cruddiy.com

GNU Affero General Public License v3.0

253 stars 80 forks source link

:shield: Security vulnerabilities #39

Open hitisec opened 3 years ago

hitisec commented 3 years ago

Hi, Some potential security vulnerabilities has been identified in this repository. Please Validate reports submitted on huntr and if are valid please mark them valid there. The report links are the following:

https://huntr.dev/bounties/b32f3a6d-e532-4ad3-a280-0e8f719805be/ https://huntr.dev/bounties/d59110a2-0329-4460-88fc-44e331b5cb4a/ https://huntr.dev/bounties/69d295f3-05e1-467a-b3eb-aae002cb6a91/ https://huntr.dev/bounties/d5e617d4-81a1-43dc-b2f5-509726812e9f/

jan-vandenberg commented 2 years ago

I have had some time to look at this, and the reports seem valid HOWEVER Cruddiy is a code-generator. Therefore the code it generates is what really matters, and the code that generates it will be deleted. I'd be happy to look at vulnerabilities in the generated code.

ray-ang commented 2 years ago

Created pull request #46 to hopefully mitigate XSS attacks by escaping the row value output.