|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #51722 Cross Site Scripting Vulnerability on Bug Tracking Site
Submitted: 2010-05-02 23:25 UTC Modified: 2010-05-03 00:13 UTC
Avg. Score:5.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: tedivm at tedivm dot com Assigned: derick (profile)
Status: Closed Package: Website problem
PHP Version: Irrelevant OS:
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please !
Your email address:
Solve the problem:
33 + 35 = ?
Subscribe to this entry?

 [2010-05-02 23:25 UTC] tedivm at tedivm dot com
The search engine does not sanitize it's input, thus allowing an xss 

The vulnerability has been posted on a blog and reposted on Reddit 
(, but 
since I didn't see a bug report for it and it's 
still active I'm assuming it hasn't been picked up by you guys.

Test script:

Expected result:
I expect the injected javascript not to run.

Actual result:
The injected javascript runs.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2010-05-03 00:12 UTC]
Automatic comment from SVN on behalf of derick
Log: - Fixed bug #51722.
 [2010-05-03 00:13 UTC]
-Status: Open +Status: Closed -Assigned To: +Assigned To: derick
 [2010-05-03 00:13 UTC]
This bug has been fixed in SVN. Since the websites are not directly
updated from the SVN server, the fix might need some time to spread
across the globe to all mirror sites, including itself.

Thank you for the report, and for helping us make better.

Thanks for the report!
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Feb 25 10:01:26 2024 UTC