Added by beat over 15 years ago. Updated over 15 years ago.
100%
Description
cbgroupjive.class.php line 2424:
return '<input type="text" id="' . $id . '" name="' . $id . '" value="' . $value . '" class="' . $class . '" size="' . $size . '" onchange="' . $onchange . '" />';
This unhtmlescaped vlaue results in a backend XSS vulnerability on searches, at very least.
Related issues 1 (0 open — 1 closed)
Related to Is duplicate of Has duplicate Blocks Blocked by Precedes Follows Copied to Copied from Issue # Delay: days Cancel Multiple values allowed (comma separated).
admin.cbgroupjive.html.php has many unescaped outputs, giving potential injections: e.g.:
'<td><a href="javascript: void(0);" onclick="' . $editJs . '">' . $row->name . '</a></td>'
could be safer as (admitting that $editJs is safe::
'<td><a href="javascript: void(0);" onclick="' . $editJs . '">' . htmlspecialchars( $row->name ) . '</a></td>'
Fixed with r1607
Also available in: PDF Atom
Updated by 
Updated by