Loading...

XML

Word

Printable

Affected Branches:
MOODLE_31_STABLE, MOODLE_32_STABLE, MOODLE_34_STABLE, MOODLE_35_STABLE, MOODLE_36_STABLE
Fixed Branches:
MOODLE_34_STABLE, MOODLE_35_STABLE
Pull from Repository:
https://github.com/dravek/moodle
Pull Main Branch:
~~MDL-58409~~-master_needs_clean_in_autocomplete_element
Pull Main Diff URL:
https://github.com/moodle/moodle/compare/master...dravek:MDL-58409-master_needs_clean_in_autocomplete_element?expand=1
Difficulty:
Easy
Testing Instructions:
Hide

Create a new activity instance (e.g. Assign) and edit the settings for this module once done.

In the Tags text field under the Tags section, enter:

<script>alert("XSS!");</script>

and hit enter

Verify you don't see a browser alert and;

Verify you see the tag created above the field, with the content you entered.

Repeat steps 1-4 for a course tag, using the course edit form.
Show
Create a new activity instance (e.g. Assign) and edit the settings for this module once done. In the Tags text field under the Tags section, enter: <script>alert( "XSS!" );</script> and hit enter Verify you don't see a browser alert and; Verify you see the tag created above the field, with the content you entered. Repeat steps 1-4 for a course tag, using the course edit form.

I am reporting a XSS security issues in accordance with Bug in Tag feature.

Tag feature in any pages has XSS vulnerability.

Here are steps for how to reproduce below.

(1) Create a new quiz instance, open edit from.

(2) Enter <script> tag e.g(<script>alert("XSS!");</script>)

(3) !?

has a non-specific relationship to

MDL-61359 Self-XSS when sending message to another user

is duplicated by

MDL-58923 Autocomplete form element does not escape string when adding to the list of tags for the editing user

Testing discovered

MDL-63082 Encoding problem with tags saved with special characters

Participants:: Anna Carissa Sadia, CiBoT, David Carrillo, Eloy Lafuente (stronk7), Jake Dallimore, Marina Glancy, Michael Hawkins, Takayuki Fuwa

Estimated:

Remaining:

Logged:

30m