Re: Security Bug on pgadmin 4 6.12

From: Aditya Toshniwal <aditya(dot)toshniwal(at)enterprisedb(dot)com>
To: Khoa Bùi Đức Anh <khoabda305(at)gmail(dot)com>
Cc: pgadmin-hackers <pgadmin-hackers(at)postgresql(dot)org>
Subject: Re: Security Bug on pgadmin 4 6.12
Date: 2022-08-22 09:59:28
Message-ID: CAM9w-_n8pE41=PbbcCr_TJ6aGSuVyGcn2aPbU2NUK1OV1BYnfA@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgadmin-hackers

Thank you for reporting this. We will fix this before the next release.

Please report it here -
https://redmine.postgresql.org/projects/pgadmin4/issues/new

On Mon, Aug 22, 2022 at 3:03 PM Khoa Bùi Đức Anh <khoabda305(at)gmail(dot)com>
wrote:

> Hi team I found a XSS vulnerabillity on the latest pgAdmin4 (6.12).
>
> Step by step
>
> Bug is at API /browser/server/obj/7/
> Object -> Register -> Server -> Connection
> Fill in Hostname/address value ss"><iframe
> src=javascript:alert(document.domain)>
> Click save, XSS fired
>
> Anymore information, you can ask me
>
> Thanks
> khoabda
>

--
Thanks,
Aditya Toshniwal
pgAdmin Hacker | Software Architect | *edbpostgres.com*
<http://edbpostgres.com>
"Don't Complain about Heat, Plant a TREE"

In response to

Responses

Browse pgadmin-hackers by date

  From Date Subject
Next Message Nikhil Mohite 2022-08-22 10:16:50 [pgAdmin][RM-7633]: On startup, autofocus on master password input.
Previous Message Akshay Joshi 2022-08-22 09:22:52 Re: [pgAdmin][RM7579] Multiple query tool fixes