-
Type:
Bug
-
Status: Open
-
Priority:
Minor
-
Resolution: Unresolved
-
Affects Version/s: None
-
Fix Version/s: None
-
Component/s: Security, Security / Rights
Improper/Weak Input Sanitizing for HTML/JavaScript Injection
Proof of Concept
- Login to the application with privileged user.
- While a privileged user edits a user's details from "Administration -> Users & Groups" page, a HTML/JavaScript codes can be placed as user's "First Name", "Last Name", "Company" information.
Suggested Fix
Certain types of HTML tags and JavaScript codes should not be allowed as filename, user profile's info.