a1dert/lh-tickets-test — Issue #411: The website is vulnerable to Cross-Site Scripting attacks.
Author: a1dert
Created: 2011-11-30 12:14:22+00:00
State: open

Imported from lighthouse. Original ticket at: http://redtape.lighthouseapp.com/projects/59696/tickets/108. Created by Adina Moldovan - 2010-11-22T13:32:32Z

The input is not validated for any of the text area fields and this allows a user to upload and run a script for all the users on one account.

We've added in the 'last name' field for a user the following code:

This will load a picture from the internet and display an alert when any user from that account will login. Please see the attached screenshot or login with

testaltom16@altom.ro, password:letmein. This shows that any script can be run if added in any of the text fields in the application.

To fix this, please validate the input for any field the user can add data in.