| शीर्षक | Guizhou Qianhu Technology Co., Ltd. FoxCMS ≤ v1.2 Reflected Cross-Site Scripting (Reflected XSS, CWE-79) |
|---|
| विवरण | A reflected cross-site scripting (XSS) vulnerability exists in FoxCMS (≤ v1.2) in the Search page. The keyword parameter is echoed back to the page without proper context-sensitive encoding, allowing an attacker to inject JavaScript.
Proof-of-concept (example):
GET /index.php/Search?fields=title&kwtype=1&keyword=321"%20onmouseover="alert(document.cookie);
When a victim opens the crafted URL, the injected script executes (demonstrable via alert(1) or alert(document.cookie)). Impact: an attacker can execute arbitrary JavaScript in the victim’s browser, potentially stealing non-HttpOnly cookies, performing phishing, CSRF chaining, or conducting actions on behalf of the user.
Mitigation: perform context-aware output encoding when rendering keyword (e.g. HTML-attribute encoding), enforce input validation/length limits, and set sensitive cookies with HttpOnly; Secure; SameSite. Deploy a strict Content Security Policy (CSP) as an additional defense. Suggested severity: Medium (escalate to High if session identifiers are stored in readable cookies). |
|---|
| स्रोत | ⚠️ https://github.com/coolcj-stack/FoxCMS-V1.2-is-vulnerable-to-cross-site-scripting-attacks.-There-is-an-XSS-vulnerability |
|---|
| उपयोगकर्ता | BlackSpdier (UID 89912) |
|---|
| सबमिशन | 24/09/2025 04:02 PM (1 वर्ष पहले) |
|---|
| संयम | 04/10/2025 08:57 PM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 327187 [qianfox FoxCMS तक 1.2 Search Page /index.php/Search keyword क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|