Item13796: Topics that process URLPARAM input with CALC / CALCULATE macros can be used to inject script tags.

True remote XSS - not needed to be logged in

-- JozefMojzis - 05 Oct 2015

This is pretty much going to apply to any topic that uses %URLPARAM with the default "safe" encoding. The % based exploit is going to get around safe encoding. I tried adding % to the default encoding, but it broke a lot of stuff. This needs some thought.

-- GeorgeClark - 05 Oct 2015

The solution is to block CALC / CALCULATE macros from emitting < or > from any functions. Per our security procedures, these attacks are considered Severity 3, and are handled through the normal task reporting process. No CVE notification is required.

-- Main.GeorgeClark - 16 Oct 2015 - 02:54

Commenting is disabled while not logged in