| शीर्षक | pihome-shc PiHome 1.77 Cross Site Scripting |
|---|
| विवरण | The web application is vulnerable to XSS attacks within the index.php. Attackers can exploit this vulnerability by injecting malicious payload in the url and steal cookies if the cookie flags are not set properly.
The code below shows (index.php from line 344) that the user input is put into the html source without sanitation. This is a high risk vulnerability.
```php
echo '<div class="panel-body">
<div class="row">
<form method="post" action="'.$_SERVER['PHP_SELF'].'" role="form">';
include("notice.php");
echo '<br>
<fieldset>
<div class="form-group">';
if ($no_ap == 0 || $wifi_connected == 1 || $eth_connected == 1 || $ap_mode == 1) {
echo '<input class="form-control" placeholder="User Name" name="username" type="input" value="';
if(isset($_COOKIE["user_login"])) { echo $_COOKIE["user_login"]; }
echo '" autofocus>';
```
The developer should escape all input properly. This is a repository wide issue.
|
|---|
| स्रोत | ⚠️ https://www.singto.io/pocsforexploits/pihome_xss_index.md |
|---|
| उपयोगकर्ता | Jelle Janssens (UID 81048) |
|---|
| सबमिशन | 10/02/2025 12:59 PM (2 साल पहले) |
|---|
| संयम | 10/02/2025 11:45 PM (11 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 295172 [pihome-shc PiHome 1.77 /index.php $_SERVER['PHP_SELF'] क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|