{"action":"created","issue":{"url":"https://api.github.com/repos/jekkos/opensourcepos/issues/39","repository_url":"https://api.github.com/repos/jekkos/opensourcepos","labels_url":"https://api.github.com/repos/jekkos/opensourcepos/issues/39/labels{/name}","comments_url":"https://api.github.com/repos/jekkos/opensourcepos/issues/39/comments","events_url":"https://api.github.com/repos/jekkos/opensourcepos/issues/39/events","html_url":"https://github.com/jekkos/opensourcepos/issues/39","id":59640260,"number":39,"title":"Stored XSS issues in multiple screens","user":{"login":"jekkos","id":576234,"avatar_url":"https://avatars.githubusercontent.com/u/576234?v=3","gravatar_id":"","url":"https://api.github.com/users/jekkos","html_url":"https://github.com/jekkos","followers_url":"https://api.github.com/users/jekkos/followers","following_url":"https://api.github.com/users/jekkos/following{/other_user}","gists_url":"https://api.github.com/users/jekkos/gists{/gist_id}","starred_url":"https://api.github.com/users/jekkos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jekkos/subscriptions","organizations_url":"https://api.github.com/users/jekkos/orgs","repos_url":"https://api.github.com/users/jekkos/repos","events_url":"https://api.github.com/users/jekkos/events{/privacy}","received_events_url":"https://api.github.com/users/jekkos/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/jekkos/opensourcepos/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"daN4cat","id":636048,"avatar_url":"https://avatars.githubusercontent.com/u/636048?v=3","gravatar_id":"","url":"https://api.github.com/users/daN4cat","html_url":"https://github.com/daN4cat","followers_url":"https://api.github.com/users/daN4cat/followers","following_url":"https://api.github.com/users/daN4cat/following{/other_user}","gists_url":"https://api.github.com/users/daN4cat/gists{/gist_id}","starred_url":"https://api.github.com/users/daN4cat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daN4cat/subscriptions","organizations_url":"https://api.github.com/users/daN4cat/orgs","repos_url":"https://api.github.com/users/daN4cat/repos","events_url":"https://api.github.com/users/daN4cat/events{/privacy}","received_events_url":"https://api.github.com/users/daN4cat/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/jekkos/opensourcepos/milestones/5","html_url":"https://github.com/jekkos/opensourcepos/milestones/3.0","labels_url":"https://api.github.com/repos/jekkos/opensourcepos/milestones/5/labels","id":1630687,"number":5,"title":"3.0","description":"","creator":{"login":"daN4cat","id":636048,"avatar_url":"https://avatars.githubusercontent.com/u/636048?v=3","gravatar_id":"","url":"https://api.github.com/users/daN4cat","html_url":"https://github.com/daN4cat","followers_url":"https://api.github.com/users/daN4cat/followers","following_url":"https://api.github.com/users/daN4cat/following{/other_user}","gists_url":"https://api.github.com/users/daN4cat/gists{/gist_id}","starred_url":"https://api.github.com/users/daN4cat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daN4cat/subscriptions","organizations_url":"https://api.github.com/users/daN4cat/orgs","repos_url":"https://api.github.com/users/daN4cat/repos","events_url":"https://api.github.com/users/daN4cat/events{/privacy}","received_events_url":"https://api.github.com/users/daN4cat/received_events","type":"User","site_admin":false},"open_issues":28,"closed_issues":151,"state":"open","created_at":"2016-03-08T14:47:47Z","updated_at":"2016-06-21T17:14:10Z","due_on":"2016-09-03T23:00:00Z","closed_at":null},"comments":46,"created_at":"2015-03-03T13:20:14Z","updated_at":"2016-06-21T17:50:24Z","closed_at":null,"body":"Hi, i would like to report a stored XSS vulnerability inside de open source POS application. I tested the sourceforge code and found the following list of vulnerable parameter:\r\n\r\n-Customer > last name, first name, phone number\r\n-ALL > welcome <name lastname>\r\n-list of items > UPC/EAN/ISBN, item name, category\r\n-item kits > item kit name, item kit description\r\n-suppliers > company name, last name, first name, phone number\r\n-items receiving > select supplier search, item name\r\n-receivings receipt > item name, employee name, payment type\r\n-sales register > item name, select customer search\r\n-sales receipt > employee, item\r\n-list of employees > lastname, first name, phone number.\r\n-when creating item> category list\r\n-gift card> customer list\r\n-store config> company name, stock, company address, company phone\r\n\r\nI also tested a couple of fields on the github code and the issue is present\r\n\r\nto replicate the issue just enter <img src=a onerror=alert(1)> on the fields mentioned. please let me know if you need more information.\r\n\r\nArturo Rodriguez\r\nSecurity Consultant"},"comment":{"url":"https://api.github.com/repos/jekkos/opensourcepos/issues/comments/227518342","html_url":"https://github.com/jekkos/opensourcepos/issues/39#issuecomment-227518342","issue_url":"https://api.github.com/repos/jekkos/opensourcepos/issues/39","id":227518342,"user":{"login":"daN4cat","id":636048,"avatar_url":"https://avatars.githubusercontent.com/u/636048?v=3","gravatar_id":"","url":"https://api.github.com/users/daN4cat","html_url":"https://github.com/daN4cat","followers_url":"https://api.github.com/users/daN4cat/followers","following_url":"https://api.github.com/users/daN4cat/following{/other_user}","gists_url":"https://api.github.com/users/daN4cat/gists{/gist_id}","starred_url":"https://api.github.com/users/daN4cat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daN4cat/subscriptions","organizations_url":"https://api.github.com/users/daN4cat/orgs","repos_url":"https://api.github.com/users/daN4cat/repos","events_url":"https://api.github.com/users/daN4cat/events{/privacy}","received_events_url":"https://api.github.com/users/daN4cat/received_events","type":"User","site_admin":false},"created_at":"2016-06-21T17:50:24Z","updated_at":"2016-06-21T17:50:24Z","body":"I made a test on each view adding `<script>alert(‘XSS attack’)</script>` just to make sure the basic sanitasation is working and it's effective. The injection appears as `[removed]alert(‘XSS attack’)[removed]`"}}
{"actor":{"display_login":"daN4cat"}}