Insufficient validation of form input
(1) By anonymous on 2021-09-13 12:56:01 [source]
On a POST
request with content type multipart/form-data
the names of the parameters are not properly sanitized. See lines 600 and 606. This makes it possible to set parameters such as FOSSIL_USER
.
(2) By D. Richard Hipp (drh) on 2021-11-26 12:28:09 in reply to 1 [link] [source]
Thanks for catching and reporting this. Should now be fixed on trunk.