Bookmarks: Delete all existing bookmarks of a user
Unknown
Vulnerability Details
A logical bug in the bookmark app makes it possible to delete all the existing bookmarks of the user.
Here are the steps to reproduce:
- Create couple of valid bookmarks
- Import a bookmark.html file that contains the line **<a href="">Bookmark</a>**. All the bookmarks of the user is replaced with blank url and Bookmark as description.
- This is potentially a risk where a user could be sent malicious html file to delete the bookmarks or this could even happen unintentionally if the user uploads a html with blank urls.
The logical flaw resides in the method **/apps/bookmarks/controller/lib/bookmarks.php** -> **addBookmark** where SQL query will select all the bookmarks and update them.
Actions
View on HackerOneReport Stats
- Report ID: 154529
- State: Closed
- Substate: resolved
- Upvotes: 4