Security Research
CVE-2023-24488 QR Code Generator XSS: A Stored XSS on code-projects.org
Thinking
2023-02-21
4 min read
Research Dossier
#Vulnerability Analysis#Code Audit#Web Security
The open-source QR Code Generator on code-projects.org concatenates user input directly into an href link when generating the QR Code preview — write a javascript:alert(1) in, and the moment the QR Code is scanned, XSS fires.
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a4d4b6d4ade7253d06d61bf923572a6b8c253d117e8b63642be9ad8c68eaee7d4a02592bcdbd3155abcc6a953135deec61ed6729ad92ae056a76758bfc9dbe3a6985cd89376a1812fe3c1ad5bb4a1f33e6370e8e853410be8bd237ecdceedc446832b400a3a8865694563f6753b250db1045cd26fb1d7e85c25af52b7777e97caa89f1980b65d486a5a4e42beb9f7f2d576a471569e15fad1f7fdb008eb6ed8532ce193ca829e759402d740e663b915a710bc06842046e9f2b4d95a2dc3135fdbee5040cdc1cba8e827bf47c8595d9e4eb208ff68ffb5748d6f876a8586f53963834fa8307945207f92d17725511770433b1a3c8def962baa9be58049182b95320419259f19c6ac76b5295c812b0bda907a657cf75316eaccb2290053cfc91a6347a98ce22fa9904f921e33dd53c96a6026a9833e774adb3abdfa8a5f8ea8eb49aeb475c4b0e94dff3114daefdc20c84ea2d7523fdd627f774f181ba0314393ab7ac7f598d89d20b8d2701aef88552035374d29d2ad2b7e77e69b0e14c982b4b5ba9d491617d0ee0e2b09c77057e203d63d4def8685eba389aefbf1c350e733427fecef9e3448635a90e7fd8d95954872d2bdb4a68219fb84950e9ccf332105a4ee98fc395be8aaa078a318f596a56cf17a593146814b0ec81e196cc44696bc3731986cc8922d75fcbb60a86059bb9c25996834d275f34e9b9b8cf8b404e638248ba33c1bd43cd9d03974ff34cc1daee4495393678b9e1f8ae0d9f96bf7c4479e4744ddf19380eb927051875d0d200ba65302f2e0319792b7a1aabda957882bd0938b77a67853ddcb3ffe741c3c5728d2daa43b1d2beba4ba3deb6ca11ada159291f429f71714a15cc6d32469abe519adf6cb74a55f33ca4adc03405624663cf6e36070a26bdd0a8ae4b6fabee94a0262c240e51d3ac65141efb0579a9dc732635cd0ffcf0ae9a44820ddd9abeeafc0ce874ed593af97e40cf7994079586cbd6000778086fac03b991d367c98e940bfc94076d5e20fb67646c65bbd685011b220a57d14a4925530f2602ea82ff8c5c2f4210d0242e98d7d65cc8846461c4dd9005c1bfac6048af1755a4266f7dfb315ddf64a0cfb6e4a8f31d08cef495481dbcdb5872c8d18c1f2621d25209618eabe7ff7b7e36bb66c470d0a2e4a66ad7b96c2b508e6a151ed8eb530aeaded54a7c2cbd847c71014794a501d7cf66b65e4a7a2342d759d9f15001c7eec5c9141ad6f84f23263055a99fd97125dff29906220a40b593474f3a4228773f780b4e68094135893f95d02d649fb793528e1fac5938931074d348dde0d0b6eb0e4433c4fcb71494dd39401a8f261471e950c6202d2058032f31d9f61c1e9019a42573645e4adab0b2190c59d34b8f47039f21ef77ddd99fdae37a285a8629dde89d7a2b5f74b0a4f0106f11fb3763e90c811cfd6101e2456e4564f5d95c2ee3d823e880d2a4d3b2c34cb66810e91e92c6e3204beff6162a472a75298a8bc4447d895602f6b66e58e5e8e713bc3cfb283feafa1065812e3c7cb114591cba4038ddb12e729831781d780aa49e7f4ed123de4864e9927218fbbf0df96ee982b0f47ac7dea979271c3c29c2d93b8b85f1325669600d06d443cd9d4d7bc6792757adb2ee31c28ae22f9eab21aefa55f830efeb5ac04d92473887c8b4579aa2a15319cbce60b0bff2f08655ac5f7397ee2cb36cf4dad0d8184fb91a11a9b06c1ad91eb678a2fe67f04bbe1df6572d42aa84567f117f0a2f68ab2c23a94bb82fc37fdfba5a3b75a1de89b40028043a21ee0a4368b58b7cd6b2465fb691fca0b4d3938ec2d95bd0d8e52556edf42492f47240588b7cc1985446ad5bd54829ba0bf6ac7cc87a54414fc4f1dd40a26e1459157b532dcea0012367fc11041b6c68f4f4fb0b283f7a43941ed93141f45ef1e301185253ee6d83cfda0ece943076ca94c6942954a1628c96979fe9b35a09da39dd9b4548bf8c9160b05d037ce052764ac942f83d8d09637284301390a193fd52dec408155bfee592b4a49136a106db025b899b4b5dcc017fb86195ec8331336965ec563c4f497b3386c1eb530251744b354c6085c80802770ddc96d42cd83d64553b830c72a9c65027ed21663a008a17064d4386f2b8e9700a40c55e0290a33f2411074115e36e47338324eb20f7bc5ca12317018c9f09d92a3ee1c580dab649eff680e406f10c77a0461b2b9f192920a6595ad092f5c05c76d2b68aefedbdc90aa1748dc5ccb9d667d332e18aa0b91ca83f767adb0775c984414c3c1820db41e9625bfdaf2663a7d6dea34f556d4c8d43a9c73020692e2c6087ac6324bdee33e5f9748b672258731ef12efbf520e65fd07da0e9e33da0348af5704b2f2f11c6866829dda4f621c594b31734b0b1c6e7274a639050eec595d719e0e2fd03c32aa689e4fc684874fadc501d523e4394e2c1fc913ed89564c83a919ac74c993fab660550987de28d773f56d198f246b9705b6e3c66d865ba3163178f2f48051db65a9766210ceed0e442f90f1a32af4038032ee4bf106a883f7e1982ed25c2b7d6e4c03441d23cc70db66698878e1cbe58cf2812660ef355bb8efa2491fc0377d7ddbd6e5ae1f334d0c5dbde5a041fe918964934d17f430c353227edddf1d761f4f8697edde5629e854054b19d6b870d5daea2b240459ecf99f2f2a21b9263bee48b1068facf61f20f967ea600c251c487ae2f81dc80c6f60026e84dfb8fc6cd4a7173319974287865b6f1152027e3bb85f3de2a44d30d999606b146f81bfc4615241418a85a7eaaac1687f31456f3958c51eeedc15affed5f49727fb84d4ce013c208aecd5b2412daaabcf5a79908008a356250c63429ec5f744f22a0e36d3306870245f46bb6cc59a855d139c97594df538b227f80364e66bc4feda8e659ce997565c86203d5c5e420e552c11dc375ae4579b02b7dddf31792cba6342770896f589263029dd5319eba2d99ae35283a8faa816a6812e709f7a63110ddcb085f3e035018b9bccebc50461d41835e7aaf36c563a5034aa2d5e2d83f71fda177dc14294d503c454d430a18fbfacf2ed0895580be6d8e72e845b01ff6d370ebb083c62263740c52e04b6c5cd8ab8d1b3fd48162fd4ca6acc54bb516c864128ba5771d87c4cc3a799a12cc642746c639536a7030a6cddf3c6d92c5fd275b9117b1137d2330e09a0abe4d8d97f9d0121b9597046c062f0dd3f88f2a2dcaa026479b5e25090ad2d5c2b310667a5aa45e3d158314729bbbe9321580f805bf12ba74093f5dea2ee66f54275f8eb23560d7276a682acc07558cc7c200953bfc2ce1bfa53d3edb411f1ee0d50610b9918e8b3a2b0a55d714aba83833ce8f23ce4a6e52b71153437658774d283b09ee54099fb3000ab0bcf58aa6c4efb5015766697b77efa1abdcc2f4fd68a4f0f035cf6a68278835501d3d74b5dfb792de4dd45bb4a2a941efd59c7cc83c11ee825c1dcdd6cc6b78f20ee8aa86c16df41b4df85fac37f036a73223d66c31c9d8e6f23a6236cf22d494d70e911e84cbc3682a4b6ea1031fb553a953799a893698356b2968f3b1463500cfc8a7860a6f4b17b2ddcb08e0f3c1acef882feb5ab481cc766e880bb7925eeb84de81e618dbf110c8cf426edfa995ed80999a3c5b973e73fb7bf5e5e91b6234d8e22253b2b8988c6e7a2793d68ea220522937f5415940617fee7ad3259288fdc807687471f1e03b7a3a279e1c516e6f18aa30e3f2f7dfb098b13b9240e0f594103f1d91b2c8dfd56ef9a9f6adeb6d9e06efb4ae2a92f83c11e62ccb6e07eefb3f9d7f9a1c3b264e7b17b1e4bc6d618717292645c5d67957a3c83a299bdf8f3bab3388ddf3f7219b298324dba0069adb7e430839633f1ae20cda50a57d5c19fd21cecd8d8793e7657a8720cb3d3088bec755e74b0aa5912dc59097e85562538c073b67d8187a3a57799f7dc4d2cf159d9b9f5ec7468dae2d46b471ee5bc7e3b15aa12a65251f99db1d2c6d9cc5f7069bd7c9a5cbbfb31c0451fdf0ea19d34a99ecd1811ff60a5f4e8c8f1bd0b470ca93e46a7985a3cc8a57f9f585fddc8851dc81d85333c715efac009cce5dc458dc2ab7e12551177dbca38bfa5a1804d3f9f80978db640df34f562ebe45858e8594374e50373d4d93dadf3ad781e449439e47350b9d535741ca0ceae92c755a615e4166746fef6c4c4a3bd11fe00244c8301db3fec3f11753eea7c6ec28838c47b6221edb41e8334067ea5532a671b10f6d12d95ff1f658daf70b97742e58297e2c6d067053e78afd1398cef187d0ea4d83928455d3ce81550833c9e1f16a5ded8a7ff972b72dc3a2501b8a539aac35b8fbd7cbccd7e2558d116b8ffb55cc1ffed5de8643bc213fa7f3d4b7062e86ff29c826bb4b6f0c9829d52fd3cae8c51f3d96ddd85b27d1baafef762bb6f7ba43d3effc84e81599c2215eff1851c2c6004158994a4e679660d1f7bab6bfb6f6163adf0d10ca5cb6c0d599120e2a124f3ff52628e7a86afcd6768705aa63a1aeb69ff37fab132e6aea8ee1f44df287e4928467fd7e259dbbedadac84c92fec5cde9056a4a46226a7c416a2f04f10ca336fe8d2c4e2d5139859fce8a820b253540de13349cbc8eb8a51160210a1765ef37dbeb2ac7d7db796c4b871bcb4b04973cda25c4cd8340117ec048e36c887b279e0d7507622318f5a762b1da998c24e8ebf5187f1cb5964fdca5d65fc2686f2e605a5b43cedd66bfe352bd0d6da908d6b1092255b39161953e0c1dd59f6a5af889fb0cb9c7368fdc11ba055641dea9c02c4cc2ac3e616b14651e45f7c542b7b1d3b676565b4c596227ae13925c2550a395b2080e5db658be94ab8024d7f82e60eff9057ba37c94a567d48a2c4b7dcb04c5ab240deb047f84e618d99dcde7c1bb29393348f83462b0e511b11be80e6f51b621b2277afce654742cbf2b894e86cd13f47c4a69f5e5f107e65f6c023d3442f46479331813a4da552d44ce25975f723e4a9eecafe2864d88752b12303c69b5ea1175c9bdfa77af7373d13d33cc187d7479fc531089acbe116d609c1465d88fb752a1c33d70ecb797e5a3099a12839dca7fda04915d329b5f5389912e4846bff06ae2fcfb3c06c4eb45b4092a004ae72b3bd86fe990f56cbbe34b3fd4043d23697edc2230bc7d7202e06dbda0ce28b3a105852730671347f7012eaddd1a2c060d9f3070fe0535e73698bcfc018d3ee2aa9cd706fe0f577b8c2bc521fd8cb5f4020b89696b4f3bd8cf0058ef2db2f0f19a07bfbc6bae00368c3708e933fc51550c00da76ebf557c23ca70fb36f398a6ccb870dcc9b2d0a3676df4ee33450d38f0fef88bafde9ff14791f54f97457683ef551b7608549d6ea28b099d6150334c2d683f0b983829ffe63c79724062b6dfd2c3128d7a1779e2de044cc8478285a63dcb6f1f02a6be4433eee6f26a68599bbd264deff6583900faae04364cf398d7397f7c4f595544573a31c7f9aab89e3625d6045122c405a7ac8aefa8475a0a993829796c9ab6caf00b801d5ac3254eeacc1b3b0506b5b3d872b79cefb3d2cfd47bf33828f7650ca761f3e0c933d3be56981973ef0b84adf49bb77c0771e39aedd8064079e9b33e498d3d305e11a5be7789b68a11d93d82ac615e5bb3343a4bdb875776e125d3d2312461220ff51ed0df4e324d0a899632d4c278fffd3d823f326710d2995104918ec62f7bada3f43238202887d86f86248673b81fb87fcffb0c5b137d1321435cc760d135c9a00b75cac4feb2d7658404b63c28334e648ef330fd78f0240ec94f317379041be931a7dce985fbe3e1b876a5cc705c64c60242fd01287901ea6bfcc8c89dd34f733a1681cd0f253d886821746df577914f80c314cf49a7e4648a5ed31435937b74345f6f03a40d948201fb9ff5f4edfe5c7554a22b70f043dc60ec2f86ebdf0884114743bcc0ef86454790203be4cdd2186e1f96f429e7c030edaacbd434d6fb658c1727f3c76b3fa882badd06b157312c87b1c423ac1efb4f55c5bcbad76210b1da9ed14873355302f1c631a182ff7100e12fd2d68c18e150b2c8b6c331c907212d6428ccd74c99015bad2984fe619abb74c1dda9e381ae89f662b40ad4f6a5fbc40b92081d07043d12799790c88d53d42186bc453c59fae4b22d3d2fe5970be11aabfaccf8c3ef0cc5c051847714abfe1a23261548997c979516bb45e2177d5e9de05a641ec1b1804ec588cc965e872816f5e15b07879757b0b8521a184dcbd77fbad68d42ebd3061122e2ddece7cc4b280ad13b5903218905730e13ff32aecacfe6580879507f5489be74880cd9804d48fbcf11fbffb8cc1da4513ef8466a9fdd2a94aa7f151393af7f7808e3d8377b1942d719e96832ca2a8f5c5ef46746719e499e77b94224b5af29b31df702cd5973351717ffe1eed17a64332f9c8aa61e9678ffc0a00d33485f8aa251c497da22caf8bb8924d3834f12f44162bdcfd7e96f99cfdf078410b4e191aa2ad2f37c31d5abaaf19ee105ae8f151fd87c775a11c3f6ecb79967cecd1f4a2fae0b0bc4cfef508d9216c8792182b89a81cbae795133c789ae82704571b8a72c5100a7a67b2076b90d9be7e6952df3660e36638d4e65b6ca3a178ab27fe32c8667e8999447252d4819f47811ec236b2439efbe56ced44550d209abc7ab3bcfcc5c404af5585d4360bfc297906c1cceea21ab2e4c228899b7a761c60529f399bb0f75cb53ba1ce8b41d1dbd7bd33be96c1258507fbd61cc7ed65d0a572b4514a2ff22880d435fd43b6590275d935c37a36aa681fe4198d5d02bc2f3a26dd0d8237debe59ebd2bb00a86b14af6564301d67d35e7eb77c8b62e8ff58c192179a4ac83f83f806cc3c45d56fc43b62780db0e4f1ac8508468d568716b1dd4ed2e7b587342f8efa7b3957900540d2ac4281abd153f9fad964a090b329230fd7d421aafe7be56b68fd92955c42458d45fb0710c1183fd06f4a6c3af8f6435473ca5fde12c6760fe37af7394586e1fc14d7645426445d0acc2a1f8fa593ea87f57f477e062dfb39482602435bf007ea185c11e35673c6824656a383f7e6d05c3d2649831f58f1da6835f0563df7226144b016f6b81a88932fdf8736d666b1bfe2bcd78551a8e45fa7f4acead4b8cf17f826819c59d22da428e5f13089b962d23ba111b0f78b73d7a851ec119b346e7a3ea591d333205d5d5f2a983ab950ecbdfc187c1cd709f233dd20bdf69230fb325e8d250d72e89f3c744f35cef2b43c02c9eba9f11e3ac17584a8616ba336629822dffa875d3d1276645b7fc9535f10fdfa291f54325c605bf75d99504b67a8c19009664bd865e336f73b4d5c9fb41950352b143c03247c1d32b8d7e9bd0f84e0abce9b9b687f070585bf6814f90c050a4b93c6ecc45e5f977fa01af6ec316db40bfcab0ae0b7d4dddf3fbc8b2f34c86c31f59c992d33ad21498d4b2bad06e747cb730688c9123315aa7a7dcd49bb1169303df185b2320bafedd8775360f87a176e36e690dc3726e83210a67ff991a81128d6f13ca4fa2cd6ee272e33c165d218513625aa49b2d8933e4d98da2033903e7f8b52b67bfc36eb7f2be847d8830447f8f9aa50304554a12d6211c4a84cbcc46dfdff614b88726de7162be3fe5cacaf2eafeda1909ad0f15597fe30c5999aa7b3092c77a13357306c3e71e46d454b42af1b6913b9ac8719cd3682e1e783f6bbbc73d71d6f6a9c047dd874777643f6ce28b7eb6f77c8e328245e1fc33e1e4ef9d83196965e910468d1bdf92f4e66b14ed7f3048811f7ea6a836f1bb8613a1fb2670f0616c3b6c3dbee3b65c704c327110204806b66e18a3ef0688a2996d827814de72cb8f80a2b747f3782248c6c9c084a7e42cbf74b4bfa2df0c245429278c8ac66c8dd2e75ce6b67ec6b283e55f164eb83e77999cc84d6b0070c4271d02e294dfd2