Closed
Bug 438689
Opened 17 years ago
Closed 17 years ago
XSS vulnerability in MDC login page (POST only)
Categories
(developer.mozilla.org Graveyard :: General, defect)
developer.mozilla.org Graveyard
General
Tracking
(Not tracked)
RESOLVED
FIXED
People
(Reporter: bsterne, Unassigned)
References
()
Details
(Keywords: wsec-xss)
POSTing the string:
foobar" onclick="alert(123);
in the username field results in the following HTML in the response:
<input name="name" id="nameid" tabindex="2" value="foobar" onclick="alert(123);" type="text">
Recommend using htmlentities to encode quotes, brackets, etc. in the output.
|
Reporter | |
Comment 1•17 years ago
|
||
On the registration page:
http://devmo.dekiwiki.mozilla.org/index.php?title=Special:Userlogin®ister=true
the email parameter is also vulnerable. Sample attack string:
test@foo.com" onclick="alert(123);
|
Assignee | |
Updated•13 years ago
|
Component: Deki Infrastructure → Other
|
||
Comment 3•12 years ago
|
||
Adding keywords to bugs for metrics, no action required. Sorry about bugmail spam.
Keywords: wsec-xss
|
||
Comment 4•9 years ago
|
||
For bugs that are resolved, we remove the security flag. These haven't had their flag removed, so I'm removing it now.
Group: websites-security
|
||
Updated•5 years ago
|
Product: developer.mozilla.org → developer.mozilla.org Graveyard
You need to log in
before you can comment on or make changes to this bug.
Description
•