Concrete CMS · Report #6843

Cross-Site Scripting in getMarketplacePurchaseFrame

Validstatus

2upvotes

18 Aug 2014disclosed

How it was found

The $mp->getProductBlockID() variable in the getMarketplacePurchaseFrame function (view on Github) is not being filtered properly to protect against HTML injection/XSS.

This leads to XSS vulnerabilities in (for example) connect.php on line 14 (view on Github) when visiting a URL like: dashboard/extend/connect/"%20onmouseover="alert(document.cookie)">.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original