Tickets :: Comment on [#9191] XSS Vulnerability

* Your Email Address
* Spam protection	Enter the letters below: .__ .__..__. __ . [__)\| \|\| \|/ ` \| [__)\|__\|\|__\|\__.\__\|
Comment	> I have found a Cross Site Scripting vulnerability in Gollem, > > Exploit : > http://localhost/horde/gollem/view.php?actionID=view_file&type=txt&file=<!--a75c305b1c0a6022--><script>alert("XSS")</script>&dir=../baddir/&driver=file > > Vulnerable file : view.php (Line 32 - 46) > > Vulnerable code : > > if (is_callable(array($GLOBALS['gollem_vfs'], 'readStream'))) { > $stream = $GLOBALS['gollem_vfs']->readStream($filedir, $filename); > if (is_a($stream, 'PEAR_Error')) { > Horde::logMessage($stream, __FILE__, __LINE__, PEAR_LOG_NOTICE); > printf(_("Access denied to %s"), $filename); > exit; > } > } else { > $data = $GLOBALS['gollem_vfs']->read($filedir, $filename); > if (is_a($data, 'PEAR_Error')) { > Horde::logMessage($data, __FILE__, __LINE__, PEAR_LOG_NOTICE); > printf(_("Access denied to %s"), $filename); > exit; > } > } > > I hope you fix the vulnerability asap. Patch in attachment. > > Have a nice day. > > Nicolas C. [NightMareLmW From DevSec]
Attachment
Watch this ticket