JspMyAdmin2
JspMyAdmin2 copied to clipboard
Stored XSS in sidebar and in table_data
The sidebar and table_data are vulnerable to Stored XSS, which means an attacker could store HTML code on the database that would be rendered by the browser when viewed and potentially run malicious code.
This can be fixed in the callColumn function of the SideBarLogic.java and in the DataSelectLogic function of the DataSelectLogic.java using org.apache.commons.lang.StringEscapeUtils.escapeHtml function on the data coming from the database.
CVE-2019-1000004 was assigned.
@yugandhargangu