MantisBT: master-2.10 c4afcb11

Diff Back to Repository
Author Committer Branch Timestamp Parent
dregad dregad master-2.10 2018-01-30 01:58 master-2.10 21188453
Affected Issues  0023906: CVE-2018-6403: XSS in adm_config_report.php 'value' parameter
Changeset

Fix XSS in adm_config_report.php (CVE-2018-6403)

Nguyen Tri Tuan reported this vulnerability, allowing an attacker to
inject arbitrary code through a crafted 'value' parameter.

Prevent the attack by sanitizing the variable before output.

Fixes 0023906
mod - adm_config_report.php Diff File