Cross-Site-Scripting (XSS)
Brought to you by:
jberanek
Hello there,
While doing a security check, I found a Stored Cross-Site-Scripting vulnerability in MRBS v1.11.1. The room name is printed without being wrapped with the htmlspecialchars function. This results in execution of a script placed in the room name.
Thanks,
Cuong
Could you post the relevant extract from the document here please, so I don't have to open an unknown docx file?
oke.
Last edit: Nguyễn Hữu Cường 2023-07-11
Here is it.
Thanks. I can reproduce the problem and am working on a fix.
With the bug i found, can you give me the cve or the bounty?
Now fixed (temporarily - there may be a better fix) in bc1f24f.
With the bug i found, can you give me the cve or the bounty?
This is now tracked at https://github.com/meeting-room-booking-system/mrbs-code/issues/744