Savane - Bugs: bug #13660, Cross Site Scripting [Gna!]

Savane - Bugs: bug #13660, Cross Site Scripting

Group

Show feedback again

You are not allowed to post comments on this tracker with your current authentification level.

Submitted by:	Fernando Muñoz <munozferna>
Submitted on:	Tue 09 Jun 2009 09:33:23 PM UTC

Category:	Web Frontend	Status:	None
Severity:	6 - Security	Priority:	E - Immediate
Assigned to:	Security Team <savane-security>	Open/Closed:	Open
Release:	SVN	Planned Release:
Reproducibility:	None	Privacy:	Public

I've noticed that a lot forms use $PHP_SELF in the action field. This lead to XSS problems.

No files currently attached

Depends on the following items: None found

Items that depend on this one: None found

Carbon-Copy List

-unavailable- added by munozferna (Submitted the item)

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

Please enter the title of George Orwell's famous dystopian book (it's a date):

Follow 2 latest changes.

Date	Changed By	Updated Field	Previous Value	=>	Replaced By
Tue 09 Jun 2009 09:33:23 PM UTC	munozferna	Priority	-Automatic update due to transitions settings-		E - Immediate
		Assigned to	-Automatic update due to transitions settings-		savane-security

Show feedback again