Bug #2131

PEAR::Pager allows XSS attack

Details

Request #2131	PEAR::Pager allows XSS attack
Submitted	2004-08-16 09:32 UTC
From	sou_sk at nifty dot com
Assigned	quipo
Status	Closed
Package	Pager
PHP Version	4.3.8
OS	Windows
Roadmaps	(Not assigned)

Comments

[2004-08-16 09:32 UTC] sou_sk at nifty dot com

Description:
------------
Pager has security problem. Malicious user can cause XSS problem through URL queries like this:
http://example.com/pager/example.php?"><s>oooops</s>

I checked this problem with bundled example.php on CVS latest version (Common.php,v 1.16).

Adding code bellow prevent this problem.
Common.php line:649
$qs = array_map('htmlspecialchars',$qs);