Cross-site Scripting (XSS) - Generic in emoncms/emoncms

Valid

Reported on

Jul 17th 2021

✍️ Description

Line 94 of theme.php sends unvalidated data to a web browser, which can result in the browser executing malicious code. In this case the data is sent at builtin_echo() in theme.php at line 94.

🕵️‍♂️ Proof of Concept

$q = ""; if (isset($_GET['q'])) $q = $_GET['q']; //get in line 16
<?php echo $q; ?> //print in line 94

💥 Impact

The attacker can:

Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

We have contacted a member of the emoncms team and are waiting to hear back 2 years ago
A emoncms/emoncms maintainer validated this vulnerability 2 years ago
Akshay Jain has been awarded the disclosure bounty
The fix bounty is now up for grabs
A emoncms/emoncms maintainer
2 years ago

Maintainer

Thanks Akshay Jain!

A emoncms/emoncms maintainer marked this as fixed with commit f95a43 2 years ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation