Cross Site Scripting Vulnerability in Workerman-ThinkPHP-Redis by HappyLiu2014
CVE-2021-43697

6.1MEDIUM

Key Information:

Vendor
Workerman-thinkPHP-redis Project
Status
Workerman-thinkPHP-redis
Vendor
CVE Published:
29 November 2021

Summary

The Workerman-ThinkPHP-Redis package is susceptible to Cross Site Scripting (XSS) due to improper handling of user input in the Controller.class.php file. When the script encounters an exit function that outputs the message containing the user-controllable variable $_GET{C('VAR_JSONP_HANDLER')}, an attacker can inject malicious scripts. This flaw can lead to unauthorized execution of scripts in the context of other users, compromising the security of web applications relying on this package.

References

https://github.com/happyliu2014/Workerman-ThinkPHP-Redis/...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.