tcllib: HTML injection
| Package(s): | tcllib | CVE #(s): | |||||||||
| Created: | March 16, 2015 | Updated: | May 7, 2015 | ||||||||
| Description: | The following flaw was reported against tcllib:
User supplied input is directly inserted into the <textarea> as default value, e.g. a textarea named 'ta' with a parameter of ta=XXX results in `<textarea>XXX</textarea>` This can be used to break out of the <textarea>-context and insert arbitrary HTML content such as <script>-Tags. The attack is possible using HTTP GET requests as well as POST and multipart form encoded POST requests. | ||||||||||
| Alerts: |
| ||||||||||