Trellis Desk version 1.0 suffers from a cross site scripting vulnerability.
6b438cff3035675417c83f1396c5f42b3459799ba5633c2a10ec6b3076dffaacThis problem has been reported to the author but no action taken to resolve the issue.
The search box does not sanitise data and is open to simple XSS SQL injection.
file sources/article.php find around line 519
$searchstring = $this->ifthd->input['keywords'];
Needs to have the following line added after...
$searchstring = mysql_real_escape_string( $searchstring );
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed