HTML Injection on "polls" app - comments section (possibly XSS)
该报告还没有中文解读。
原文摘录
摘自原文（1836 字符中的一小部分）
On latest version of Polls app (1.7.5), I noticed a lack of user input filtering for the "Description" part of the survey. An HTML injection is therefore possible. I tried to inject JavaScript code to get an XSS but I didn't succeed. Certainly someone better than me will be able to do it.
原文中的代码
<br/> <br/><br/><br/><br/><br/><marquee><p style="color:red;"><b>!!!!! IMPORTANT message from Nextcloud administrator !!!!!!</b></p></marquee><br/><br/> A security issue was found last night.<br/> <p style="color:green;">Please go to manually on <a><b>changing-password.cloud.evil.com</a></b> to …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Nextcloud 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @supr4s · 版权归作者与 Nextcloud 所有