Postgres Pro
Downloads
Home   >   mailing lists

Re: XSS Bug in Query View - Mailing list pgsql-bugs

From Fahar Abbas
Subject Re: XSS Bug in Query View
Date
Msg-id CAJFwRrNkdOKtiBfvopLaArzzHTRPVuSCkErS5DLDhmB-b4SorA@mail.gmail.com
Whole thread Raw
In response to XSS Bug in Query View  (Albrecht Scheidig <albrecht.scheidig@hype.de>)
List pgsql-bugs
Tree view
Hi Albrecht,

Fix will be available in next release of pgadmin4 4.9.

On Wed, Jun 19, 2019 at 8:48 PM Albrecht Scheidig <albrecht.scheidig@hype.de> wrote:

When entering the following query and hit 'execute', xss is executed:


SELECT '<<SCRIPT>alert("XSS ");//<</SCRIPT>';


pgadmin 4.8



--
Fahar Abbas
QMG
EnterpriseDB Corporation
Phone Office: +92-51-835-8874
Phone Direct: +92-51-8466803
Mobile: +92-333-5409707
Skype ID: live:fahar.abbas
Website: www.enterprisedb.com

pgsql-bugs by date:

Previous
From: Michael Paquier
Date:
Subject: Re: BUG #15827: Unable to connect on Windows using pg_services.confusing Python psycopg2
Next
From: Daniel Gustafsson
Date:
Subject: Re: CREATE STATISTICS + Table Inheritance = ERROR: tuple alreadyupdated by self