Scada-LTS icon indicating copy to clipboard operation
Scada-LTS copied to clipboard

Fixed XSS vulnerabilities in graphical view components

Open Patrykb0802 opened this issue 1 year ago • 0 comments

Describe the bug This issue reports about XSS vulnerabilities found in graphical view components. For tests we were using project from this file: Scada-LTS-test-2669.zip

List of bugs

  • [x] In Enchanced image chart, add data point to chart, alert->"virutal ds" && alert->"Point details -> Name"
  • [ ] In Button script, Text = => alert->"abc"
  • [ ] In Simple Point, Edit graphical render => Display point name = true, Style attribute = => alert->"Point details -> Name"
  • [ ] In Simple compound, Name = => alert->abc

All alerts appear when graphical view component is loaded.

Expected behavior All fields that had any and displayed alert, should be escaped and treated as string.

Desktop:

  • OS: Linux Mint
  • Browser: Chrome
  • Version: <= 2.7.5.4

#2116

Patrykb0802 avatar Aug 24 '23 10:08 Patrykb0802