GHSA-jf9v-q8vh-3fmc

Cross-site scripting in ICEcoder

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-32106

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	icecoder/icecoder	< 8.1	8.1

Details

As written in the advisory (Markdown source, shown as plain text).

In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. As a result, arbitrary Javascript code can get executed.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-32106 advisory
https://github.com/icecoder/ICEcoder/commit/21d6ae0f2a3fce7d076ae430d48f5df56bd0f256 web
https://github.com/icecoder/ICEcoder package
https://groups.google.com/g/icecoder/c/xcAc8_1UPxQ web
https://prophaze.com/cve/icecoder-8-0-multipe-results-php-replace-cross-site-scripting web