Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[security vulnerability] Cross-Site Scripting (XSS) vulnerabilities #36

Open
GatekeeperBuster opened this issue Aug 4, 2023 · 0 comments

Comments

@GatekeeperBuster
Copy link

Recently, our team found a reflected cross-site scripting (XSS) vulnerability
The vulnerability logic is present in the file:
https://github.com/mariuz/firebirdwebadmin/blob/master/panels/tb_dropfields.php#L27

image

The echo directly outputs the parameter $_POST['drop_cols'] without any sanitization. This makes it susceptible to Cross-Site Scripting (XSS) attacks. As a result, attackers can exploit this vulnerability by injecting malicious html code with $_POST['drop_cols']

To fix this vulnerability, we recommend that developers implement properly sanitize (e.g., htmlspecialchars()) for user input before displaying it on the webpage.

@GatekeeperBuster GatekeeperBuster changed the title Cross-Site Scripting (XSS) vulnerabilities [security vulnerability] Cross-Site Scripting (XSS) vulnerabilities Aug 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant