#12720 closed Bug (invalid)
Cross Site Scripting via href click
Reported by: | Mohamed A. Baset | Owned by: | |
---|---|---|---|
Priority: | Normal | Milestone: | |
Component: | General | Version: | 4.4.6 |
Keywords: | Cc: |
Description
- Go to Source mode
- Paste this source code
<p><a href="javascript:alert(document.domain)">Click here to 50 BTC</a></p>
PoC Video: http://youtu.be/3xxLpYg4j3M
Advanced Content Filter, that is available in CKEditor and that is responsible for removing tags/attributes/styles that are not allowed, is not a security filter.
It is possible to skip any client side validation while entering content for example by:
This is the reason why the data validation has to be done on the server side and why this particular case is invalid.