Project: moodle
Issue MDL-43948: Possible reflected XSS in editor and imagefile form fields
We have the issue below reported to us via a security review of Totara, and since it also affects moodle/master I am reporting it here. I am reasonably sure that it is not exploitable, but I am not a security expert therefore I thought I'd better report it just in case. Feel free to close as not a bug if that is the case. The report is as follows: It has been detected by exploiting the parameter imagefile of the form located in URL [SITEURL]/user/edit.php?id=70&course=1 Request: POST [SITEURL]/user/edit.php Payload: {code} id=70&course=1&sesskey=xNwOTlWuU1&_qf__user_edit_form=1&mform_isexpanded_id_moodle=1&mform_isexpanded_id_moodle_picture=0&mform_isexpanded_id_moodle_interests=0&firstname=Whitney&mform_isexpanded_id_moodle_optional=0&lastname=Eldridge&email=whitney.eldridge@anaplan.com&interests[othertags]=1234&maildisplay=2&imagealt=1234&url=http://127.0.0.1/foo.html&imagefile=%22'%3E%3Cqss%20%60%3b!--%3D%26%7b()%7d%3E&mailformat=1&icq=1234&maildigest=0&skype=1234&autosubscribe=1&aim=1234&trackforums=0&yahoo=1234&htmleditor=1&msn=1234&city=San%20Francisco&idnumber=1234&institution=1234&timezone=99&department=1234&phone1=8000000000&phone2=8000000000&address=123 Main St.&submitbutton=Update%20profile {code} Response: {code} D%26%7B%28%29%7D%3E&subdirs=0&maxbytes=1048576000&areamaxbytes=-1&maxfiles=1&ctx_id=1&course=1&sesskey=xNwOTlWuU1' height='160' width='600' style='border:1px solid #000'>

" name="imagefile" type="hidden" />

Picture description
Story points: 8