Stored XSS in GazellePosterWall via Malicious Subtitle Filename

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in GazellePW (GazellePosterWall). It allows remote authenticated users to inject malicious JavaScript code via a specially crafted subtitle filename during upload. The injected script is then stored and later executed when the subtitle is rendered in the /subtitles.php?action=delete page.

Useful 0 Not Useful 0

Detection Guidance

To detect this Stored XSS vulnerability in GazellePW, inspect subtitle filenames in the upload directory for unusual or malicious JavaScript payloads. Check the /subtitles.php?action=delete endpoint for rendered output containing unexpected scripts. Review server logs for subtitle uploads with suspicious filenames.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in the context of the affected website. This could lead to session hijacking, defacement, or theft of sensitive user data like cookies or credentials. Users with authenticated sessions are at risk if they access the compromised page.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in non-compliance due to potential data breaches or unauthorized data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update GazellePW to a patched version if available. Sanitize subtitle filenames during upload to block JavaScript injection. Implement input validation to reject filenames containing script tags or special characters. Monitor /subtitles.php?action=delete for unauthorized script execution.

Useful 0 Not Useful 0