[GH-ISSUE #2501] XSS/Code-Injecting in the logs #1610

New issue

Closed

opened 2026-02-27 11:18:05 +03:00 by kerem · 1 comment

kerem commented

2026-02-27 11:18:05 +03:00

Owner

Originally created by @felix-d1strict on GitHub (Apr 23, 2022).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/2501

Hello,

I just looked in the logs and so also found that the input of users (for example in the username on a failed login) is not filtered. This makes it possible to inject malicious code into the administration interface.

A sample input in the login-form:
Username:
<script>alert("Uh-oh. This content should not be executed here.");</script>

Some Password.

Thank you very much and best regards,
Felix

PS: It would be good to have a security policy here in the repo so that people know how we (users) can report security vulnerabilities.

Originally created by @felix-d1strict on GitHub (Apr 23, 2022). Original GitHub issue: https://github.com/modoboa/modoboa/issues/2501 Hello, I just looked in the logs and so also found that the input of users (for example in the username on a failed login) is not filtered. This makes it possible to inject malicious code into the administration interface. A sample input in the login-form: Username: `<script>alert("Uh-oh. This content should not be executed here.");</script>` Some Password. ![oh-oh](https://user-images.githubusercontent.com/68828301/164837964-083c56f6-c0eb-4488-bfbb-47e6b6cfc038.png) Thank you very much and best regards, Felix PS: It would be good to have a security policy here in the repo so that people know how we (users) can report security vulnerabilities.

kerem

2026-02-27 11:18:05 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-27 11:18:06 +03:00

Author

Owner

@tonioo commented on GitHub (Apr 27, 2022):

@felix-d1Thank you for reporting this and you're right, we need a security policy.

@tonioo commented on GitHub (Apr 27, 2022): @felix-d1Thank you for reporting this and you're right, we need a security policy.