The parameter 'object[name]' is not sanitized in the page '/horde/turba/add.php'

Hello, I found a security hole in Turba H3 2.1.7 This is

Thu, 12 Jun 2008 16:28:54 +0000

Hello, I found a security hole in Turba H3 2.1.7 This is a Cross Site Scripting (XSS) vulnerability. The parameter 'object[name]' is not sanitized in the page '/horde/turba/add.php' POC: Could you tell me if this vulnerability is corrected in the last version of turba (2.2). Regards Nicolas Kerschenbaum

Yes, it is.

Thu, 12 Jun 2008 17:01:50 +0000

Yes, it is.

Well, there was another problem, but not in add.php itself -

Thu, 12 Jun 2008 18:24:58 +0000

Well, there was another problem, but not in add.php itself - are you saying the vulnerability you see is on the add form itself?

1) I add a contact (page: '/horde/turba/add.php') with the n

Fri, 13 Jun 2008 08:59:58 +0000

1) I add a contact (page: '/horde/turba/add.php') with the name : Jean Dupont http://img258.imageshack.us/img258/3708/formao0.png 2) I see my contact list (page: '/horde/services/obrowser/?path=turba/localsql:heremylogin') and there is a XSS http://img246.imageshack.us/img246/5604/xsswt6.png So, if this security bug is fixed, which version is not vulnerable ? Regards

your initial report was misleading about where the vulnerabi

Fri, 13 Jun 2008 14:58:12 +0000

your initial report was misleading about where the vulnerability is (xss is a display problem, so add.php isn't the issue). we are currently investigating.

Indeed, the page add.php is not the issue, but the parameter

Fri, 13 Jun 2008 15:43:38 +0000

Indeed, the page add.php is not the issue, but the parameter 'object[name]', saved in add.php page, is not sanitized in the page '/horde/services/obrowser/?path=turba/localsql'.

that's not even part of turba

Fri, 13 Jun 2008 15:52:26 +0000

that's not even part of turba

So could you remove this ticket, I will post a new one in th

Fri, 13 Jun 2008 15:57:39 +0000

So could you remove this ticket, I will post a new one in the Horde Bugs topic. Regards

no, i already moved it to the horde queue

Fri, 13 Jun 2008 16:12:11 +0000

no, i already moved it to the horde queue

Changes have been made in CVS for this ticket: http://cvs.h

Fri, 13 Jun 2008 21:43:31 +0000

Changes have been made in CVS for this ticket: http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.1108&r2=1.1109&ty=u http://cvs.horde.org/diff.php/horde/services/obrowser/index.php?r1=1.18&r2=1.19&ty=u

This is fixed in CVS, and Horde 3.2.1 will be out with the f

Fri, 13 Jun 2008 21:46:20 +0000

This is fixed in CVS, and Horde 3.2.1 will be out with the fix presently.