Reflected XSS Vulnerability in demo.browse.php (all version?)

j3rech0 commented 3 months ago

File Location: \demos\demo.browse.php Vulnerable Parameter: filename=

Steps to Reproduce:

Downloaded the file via github.
Browse /demos/demo.browse.php and comment out the code in Line 15 or 16 that says die('For security reasons, this demo has been disabled. It can be enabled by removing line '.__LINE__.' in demos/'.basename(__FILE__));
Then browse eg. https://YOUR_LOCAL_DOMAIN/getID3-VERSION/demos/demo.browse.php?filename=%3Cscript%3Ealert(1)%3C/script%3E

Affected version:

Tested in getID3-1.9.8, getID3-1.9.20, getID3-1.9.23, getID3-2.0.0-beta6 probably all?

PoC:

I have PoC on some running websites if you want other proof. Cheers!

JamesHeinrich commented 2 months ago

Please feel free to submit a proposed fix if you have one.

j3rech0 commented 2 months ago

@JamesHeinrich

try wrapping with htmlentities

die(htmlentities(getid3_lib::iconv_fallback($FileSystemEncoding, $PageEncoding, $_REQUEST['filename']).' does not exist'));

JamesHeinrich commented 2 months ago

JamesHeinrich / getID3