Security vulnerabilities in FlatPress 1.0.2

[omarkurt]

XSS in comment param 'content' found.

Url http://example.com/flatpress-1.0.2/?x=entry:entry131210-125112;comments:1
Parameter Name content
Parameter Type Post
Attack Pattern </textarea><scRipt>alert(9)</scRipt>

[evacchi]

Hi Omar,

Commit #924668f should close this issue.

[fgeek]

What release version contains this patch? I am talking about version number, which is shown in fp-includes/core/core.system.php file, thank you.

Here are few references for this case:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-100036
https://www.netsparker.com/critical-xss-vulnerabilities-in-flatpress/

[fgeek]

@evacchi Could you create new release, which includes this fix?

[evacchi]

Sure, will do asap
Il 10/giu/2015 17:07, "Henri Salo" notifications@github.com ha scritto:

@evacchi https://github.com/evacchi Could you create new release, which
includes this fix?

—
Reply to this email directly or view it on GitHub
https://github.com/evacchi/flatpress/issues/14#issuecomment-110788991.

[fgeek]

Thanks!

[evacchi]

out :)

[fgeek]

Added detection in to pyfiscan: fgeek/pyfiscan@1fb23c3

[evacchi]

👍