| शीर्षक | GeShi ≤1.0.9.1 Cross Site Scripting |
|---|
| विवरण | # Summary
A Cross-Site Scripting (XSS) vulnerability exists in the cssgen.php file of GeShi version x.x.x.x and earlier. This vulnerability allows attackers to inject malicious HTML code into the /contrib/cssgen.php file, which can be executed when a user views the affected page.
# Details
This vulnerability may impact all systems that use composer to install the GeShi library and have not removed the contrib directory, including but not limited to:
```
Dokuwiki
Mambo
phpBB
WikkaWiki
```
Systems using composer to install GeShi can be identified via [GitHub search](https://github.com/search?q=%22geshi%2Fgeshi%22%3A&type=code).
The cssgen.php file uses the `get_var` function to retrieve user input parameters but fails to properly sanitize or escape the input.
# POC
```
http(s)://target-ip/geshi-x.x.x.x/contrib/cssgen.php?step=3&default-styles=%3Cscript%3Ealert(document.cookie)%3C/script%3E&keywords-1=%3Cscript%3Ealert(document.cookie)%3C/script%3E&comments=%3Cscript%3Ealert(document.cookie)%3C/script%3E&escaped-chars=%3Cscript%3Ealert(document.cookie)%3C/script%3E
``` |
|---|
| स्रोत | ⚠️ https://github.com/GeSHi/geshi-1.0/issues/159 |
|---|
| उपयोगकर्ता | jiashenghe (UID 39445) |
|---|
| सबमिशन | 26/02/2025 07:42 AM (1 वर्ष पहले) |
|---|
| संयम | 08/03/2025 03:27 PM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 299036 [GeSHi तक 1.0.9.1 CSS /contrib/cssgen.php get_var क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|