[Vtigercrm-developers] XSS in migration

[Prasad]

Thank you - noted and fixed pushed.
Reference: http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/8323

*Connect with us on: *Twitter <http://twitter.com/vtigercrm> *I* Facebook
<http://www.facebook.com/pages/vtiger/226866697333578?sk=wall> *I* Blog
<https://blogs.vtiger.com/>* I* Wiki
<http://wiki.vtiger.com/vtiger6/index.php/Main_Page> *I* Website
<https://www.vtiger.com/>

On Thu, Oct 30, 2014 at 4:16 PM, Amiad Bareli <amiad at appsec-labs.com> wrote:

> I found XSS bug in the migiration:
>
> https://demo.vtiger.com/migrate/?error=%3Cscript%3Ealert%280%29;%3C/script%3EXSS
>
> (Chrome block XSS. Try other browser)
>
> Please, fix its quickly.
>
> Amiad
> AppSec Labs
>
> ---
> See more of our services here:
>
> [image:
> https://encrypted-tbn3.gstatic.com/images?q=tbn:ANd9GcTtCOu1M8zBp0UqX2-jV94wQGj-Dvk1FmsVznGLBN-h-6Y2kItD]
> <http://www.facebook.com/AppsecLabs>[image:
> http://www.artrix.co.uk/UserFiles/image/whatson/youtube.jpg]
> <http://youtu.be/0wkdPoHWkHc>[image:
> http://www.brandonu.ca/careerplanning/files/2010/08/linkedin-logo.png]
> <http://www.linkedin.com/groups/AppSec-Labs-2803406>
>
> _______________________________________________
> http://www.vtiger.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.vtigercrm.com/pipermail/vtigercrm-developers/attachments/20141030/50959189/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.jpg
Type: image/jpeg
Size: 1969 bytes
Desc: not available
URL: <http://lists.vtigercrm.com/pipermail/vtigercrm-developers/attachments/20141030/50959189/attachment-0002.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 2339 bytes
Desc: not available
URL: <http://lists.vtigercrm.com/pipermail/vtigercrm-developers/attachments/20141030/50959189/attachment-0003.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 3052 bytes
Desc: not available
URL: <http://lists.vtigercrm.com/pipermail/vtigercrm-developers/attachments/20141030/50959189/attachment-0001.png>