| Package | Affected versions | Patched versions |
|---|---|---|
| getgrav/grav | < 1.8.0-beta.27 | 1.8.0-beta.27 |
| grav-plugin-admin | ≤ 1.10.50 |
A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter.
Vulnerable Endpoint: GET /admin/pages/[page]
Parameter: data[header][content][items]
The application fails to properly validate and sanitize user input in the data[header][content][items] parameter. As a result, attackers can craft a malicious URL with an XSS payload. When this URL is accessed, the injected script is reflected back in the HTTP response and executed within the context of the victim's browser session.
Payload:
"><ImG sRc=x OnErRoR=alert('XSS-PoC3')>
Log in to the Grav Admin Panel and navigate to Pages.
Create a new page or edit an existing one.
In the Advanced > Blog Config > Items field (which maps to data[header][content][items]), insert the payload above.
Save the page.
The malicious payload is reflected and rendered by the application without proper sanitization. The JavaScript code is immediately executed in the browser.
Reflected cross-site scripting (XSS) attacks can have serious consequences, including:
User actions: Attackers can perform actions on behalf of the user
Data theft: Sensitive information such as session cookies can be stolen
Account compromise: Attackers may impersonate legitimate users
Malicious code execution: Arbitrary JavaScript code can run in the user’s browser
Website defacement or misinformation: Malicious output may be injected visually
User redirection: Victims may be redirected to phishing or malicious websites
by CVE-Hunters
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free