Recently, our team found a reflected cross-site scripting (XSS) vulnerability The vulnerability logic is present in the file:
[https://github.com/ivanlanin/kateglo/blob/master/index.php#L121]()
The echo directly outputs the parameter $_GET['phrase'] without any sanitization. This makes it susceptible to Cross-Site Scripting (XSS) attacks. As a result, attackers can exploit this vulnerability by injecting malicious html code with $_GET['phrase']. To fix this vulnerability, we recommend that developers implement properly sanitization (e.g., htmlspecialchars()) for user input before displaying it on the webpage.
Recently, our team found a reflected cross-site scripting (XSS) vulnerability The vulnerability logic is present in the file: [https://github.com/ivanlanin/kateglo/blob/master/index.php#L121]()
The
echodirectly outputs the parameter$_GET['phrase']without any sanitization. This makes it susceptible to Cross-Site Scripting (XSS) attacks. As a result, attackers can exploit this vulnerability by injecting malicious html code with$_GET['phrase']. To fix this vulnerability, we recommend that developers implement properly sanitization (e.g.,htmlspecialchars()) for user input before displaying it on the webpage.