Labels: security, bug · Severity: High (XSS)
Location: src/webserver/default/amuleweb-main-search.php:184
<a href="amuleweb-main-search.php?search_sort=<?php echo($HTTP_GET_VARS["sort"]);?>">
Description: The sort query parameter is echoed verbatim into an HTML attribute with
no escaping. An attacker can break out of the attribute and inject markup/JavaScript, e.g.
?sort="><script>...</script> or ?sort=" onmouseover="....
This is the only place where request-supplied data reaches HTML unescaped. Data coming from
the External Connection (file names, user names) is correctly escaped in C++ via
_SpecialChars() (WebSocket.cpp) before reaching the templates, so the rest of the surface
is fine — this one parameter was missed.
Impact: Reflected XSS → session theft (made worse by SEC-3, the cookie lacking
HttpOnly), CSRF token leakage, action execution as the logged-in admin.
Suggested fix: HTML-escape the value before output (whitelisting is even better, since
sort should only ever be a known column key). Audit other templates for the same pattern
as a precaution.
Labels:
security,bug· Severity: High (XSS)Location:
src/webserver/default/amuleweb-main-search.php:184Description: The
sortquery parameter is echoed verbatim into an HTML attribute withno escaping. An attacker can break out of the attribute and inject markup/JavaScript, e.g.
?sort="><script>...</script>or?sort=" onmouseover="....This is the only place where request-supplied data reaches HTML unescaped. Data coming from
the External Connection (file names, user names) is correctly escaped in C++ via
_SpecialChars()(WebSocket.cpp) before reaching the templates, so the rest of the surfaceis fine — this one parameter was missed.
Impact: Reflected XSS → session theft (made worse by SEC-3, the cookie lacking
HttpOnly), CSRF token leakage, action execution as the logged-in admin.Suggested fix: HTML-escape the value before output (whitelisting is even better, since
sortshould only ever be a known column key). Audit other templates for the same patternas a precaution.