Tickets :: Comment on [#6906] The parameter 'object[name]' is not sanitized in the page '/horde/turba/add.php'

* Your Email Address
* Spam protection	Enter the letters below: .___.__..__ . .. . [__ \| \|[__)\|__\|\| \| \| \|__\\| \\| \|\|__\|
Comment	> Hello, > > > > I found a security hole in Turba H3 2.1.7 > > This is a Cross Site Scripting (XSS) vulnerability. > > The parameter 'object[name]' is not sanitized in the page > '/horde/turba/add.php' > > > > POC: > > > > <input type="text" name="object[name]" id="object[name]" size="40" > value="<!--a75c305b1c0a6022--><script>alert('XSS by Nicolas > Kerschenbaum');</script>" maxlength="255" /> > > > > > > > > Could you tell me if this vulnerability is corrected in the last > version of turba (2.2). > > > > Regards > > > > Nicolas Kerschenbaum
Attachment
Watch this ticket