| 标题 | GeShi ≤1.0.9.1 Cross Site Scripting |
|---|
| 描述 | # Summary
A Cross-Site Scripting (XSS) vulnerability exists in the cssgen.php file of GeShi version x.x.x.x and earlier. This vulnerability allows attackers to inject malicious HTML code into the /contrib/cssgen.php file, which can be executed when a user views the affected page.
# Details
This vulnerability may impact all systems that use composer to install the GeShi library and have not removed the contrib directory, including but not limited to:
```
Dokuwiki
Mambo
phpBB
WikkaWiki
```
Systems using composer to install GeShi can be identified via [GitHub search](https://github.com/search?q=%22geshi%2Fgeshi%22%3A&type=code).
The cssgen.php file uses the `get_var` function to retrieve user input parameters but fails to properly sanitize or escape the input.
# POC
```
http(s)://target-ip/geshi-x.x.x.x/contrib/cssgen.php?step=3&default-styles=%3Cscript%3Ealert(document.cookie)%3C/script%3E&keywords-1=%3Cscript%3Ealert(document.cookie)%3C/script%3E&comments=%3Cscript%3Ealert(document.cookie)%3C/script%3E&escaped-chars=%3Cscript%3Ealert(document.cookie)%3C/script%3E
``` |
|---|
| 来源 | ⚠️ https://github.com/GeSHi/geshi-1.0/issues/159 |
|---|
| 用户 | jiashenghe (UID 39445) |
|---|
| 提交 | 2025-02-26 07時42分 (2 年前) |
|---|
| 管理 | 2025-03-08 15時27分 (10 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 299036 [GeSHi 直到 1.0.9.1 CSS /contrib/cssgen.php get_var 跨网站脚本] |
|---|
| 积分 | 20 |
|---|