Cross-site Scripting (XSS) - Generic in emoncms/emoncms

Reported on Jul 17th 2021

✍️ Description

Line 94 of theme.php sends unvalidated data to a web browser, which can result in the browser executing malicious code. In this case the data is sent at builtin_echo() in theme.php at line 94.

🕵️‍♂️ Proof of Concept

$q = ""; if (isset($_GET['q'])) $q = $_GET['q']; //get in line 16
<?php echo $q; ?> //print in line 94

💥 Impact

The attacker can:

Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

We have contacted a member of the emoncms team and are waiting to hear back 9 days ago
emoncms/emoncms maintainer validated this vulnerability 4 days ago
Akshay Jain has been awarded the disclosure bounty
The fix bounty is now up for grabs
emoncms/emoncms maintainer
4 days ago

Thanks Akshay Jain!

emoncms/emoncms maintainer confirmed that a fix has been merged on f95a43 4 days ago
The fix bounty has been dropped