Exponentcms Exponent CMS → User issues

Comments and changes to this ticket

• You flagged this item as spam.
  

  Mayuresh Dani November 4th, 2014 @ 03:19 PM

  Also a logged-in user can launch a similar attack simply by entering malicious java script into the "First Name" and "Last Name" fields on http://localhost/exponent/users/edituser. If you enter a simple script tag such as - and you save it, you get the screen shot that I have attached.

  Thanks,
  Mayuresh and Narendra

  • ExponentUser2.PNG 35.4 KB
• 

  expNinja November 5th, 2014 @ 02:12 PM

  (from [f8e878bbe4619c2bcfe4b35ed2fc795e9e384f71]) Better job of scrubbing all params coming in either by sef or query url [#1230] https://github.com/exponentcms/exponent-cms/commit/f8e878bbe4619c2b...

• 

  expNinja November 5th, 2014 @ 02:37 PM

  (from [c9a5dc3008834c01f9619215ddeb7ccf1aeefa9a]) More universal/efficient fix for scrubbing parameters [#1230] https://github.com/exponentcms/exponent-cms/commit/c9a5dc3008834c01...

• 

  expNinja November 5th, 2014 @ 06:28 PM

  (from [082ab6e21a47940927407cc0bdc10875f5deb3fa]) Better job of scrubbing all params coming in either by sef or query url #1230 https://github.com/exponentcms/exponent-cms/commit/082ab6e21a479409...

• 

  expNinja November 5th, 2014 @ 06:28 PM

  (from [e18e4d534f5b704954888a8dc9a6a0373fd54247]) More universal/efficient fix for scrubbing parameters #1230 https://github.com/exponentcms/exponent-cms/commit/e18e4d534f5b7049...

• You flagged this item as spam.
  

  Mayuresh Dani November 10th, 2014 @ 12:30 PM

  Any updates about the vulnerability in user profiles?

• You flagged this item as spam.
  

  Mayuresh Dani November 11th, 2014 @ 11:06 AM

  Okay. Would have really appreciated if you guys could have atleast mentioned us for reporting these vulnerabilities when releasing patches though. :-)

• You flagged this item as spam.
  

  Mayuresh Dani November 13th, 2014 @ 06:59 AM

  Thanks for mentioning us. :-)