Project

General

Profile

Actions
Copy link

Bug #2385

closed

not htmlescaped inputs

Bug #2385: not htmlescaped inputs

Added by beat almost 15 years ago. Updated almost 15 years ago.

Status:
Closed
Priority:
Normal
Assignee:
beat
Target version:
2.0
Start date:
08 March 2011
Due date:
% Done:

100%

Estimated time:

Description

cbgroupjive.class.php line 2424:

        return '<input type="text" id="' . $id . '" name="' . $id . '" value="' . $value . '" class="' . $class . '" size="' . $size . '" onchange="' . $onchange . '" />';

This unhtmlescaped vlaue results in a backend XSS vulnerability on searches, at very least.

Related issues 1 (0 open — 1 closed)

Related to CB GroupJive - Bug #2380: Missing htmlspecialchars in html outputClosedbeat08 March 2011

Actions
Actions
Copy link

Also available in: PDF Atom