Stored XSS in sidebar and in table_data

yugandhargangu / JspMyAdmin2

JspMyAdmin 2 - A Java Web tool for MySql database administration

http://jspmyadmin.com

GNU General Public License v2.0

86 stars 43 forks source link

Stored XSS in sidebar and in table_data #22

Open Davidepaalte opened 6 years ago

Davidepaalte commented 6 years ago

The sidebar and table_data are vulnerable to Stored XSS, which means an attacker could store HTML code on the database that would be rendered by the browser when viewed and potentially run malicious code.

This can be fixed in the callColumn function of the SideBarLogic.java and in the DataSelectLogic function of the DataSelectLogic.java using org.apache.commons.lang.StringEscapeUtils.escapeHtml function on the data coming from the database.

NicoleG25 commented 4 years ago

CVE-2019-1000004 was assigned.

@yugandhargangu