Cross-site Scripting (XSS) - Generic in emoncms/emoncms


Reported on

Jul 17th 2021

✍️ Description

Line 94 of theme.php sends unvalidated data to a web browser, which can result in the browser executing malicious code. In this case the data is sent at builtin_echo() in theme.php at line 94.

🕵️‍♂️ Proof of Concept

$q = ""; if (isset($_GET['q'])) $q = $_GET['q']; //get in line 16
<?php echo $q; ?> //print in line 94

💥 Impact

The attacker can:

Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

We have contacted a member of the emoncms team and are waiting to hear back a year ago
emoncms/emoncms maintainer validated this vulnerability a year ago
Akshay Jain has been awarded the disclosure bounty
The fix bounty is now up for grabs
emoncms/emoncms maintainer
a year ago


Thanks Akshay Jain!

emoncms/emoncms maintainer marked this as fixed with commit f95a43 a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation