Stored XSS in 299Ko Public Contact Form

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in a public contact form of a PHP flat-file CMS. The form directly inserts user-supplied input (name, firstname, email, message) into the page template without sanitization. The template engine outputs these values without escaping HTML special characters, allowing an attacker to inject malicious scripts. For example, submitting a name like "><script>alert(document.domain)</script> would execute the script when the page is viewed.

Useful 0 Not Useful 0

Detection Guidance

Check the plugin/contact/controllers/ContactController.php file for the home() function to see if raw POST fields are directly assigned to template variables without sanitization. Inspect common/Template.php for the _show_var() function to verify if htmlspecialchars() is missing when outputting variables. Examine contact.tpl to confirm if user inputs are output unescaped in HTML attributes or textarea elements.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated attacker can trick users or administrators into submitting the form with a malicious payload. This could lead to session token theft, account hijacking, or defacement of the website. Visitors or administrators viewing the form page may have their sessions compromised if they interact with the injected script.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements. For HIPAA, it may expose protected health information if user data is compromised. Both standards require safeguards against such breaches, and this vulnerability undermines those protections.

Useful 0 Not Useful 0

Mitigation Strategies

Apply input sanitization to POST fields (name, firstname, email, message) in ContactController.php before assigning them to template variables. Modify _show_var() in common/Template.php to use htmlspecialchars() when outputting variables. Update contact.tpl to escape user inputs in HTML attributes and textarea elements. Consider disabling the contact form temporarily if a patch is unavailable.

Useful 0 Not Useful 0