Summary
Reflected XSS vulnerability in php/routes.php allows remote attackers to inject arbitrary JavaScript or HTML via the apid parameter.
Details
|
$apid = $_POST["apid"] ?? $_GET["apid"] ?? null; |
|
die(_('Error') . ';' . sprintf(_('Error;No airport with ID %s found'), $apid)); |
|
die(_('Error') . ';' . sprintf(_('Error;No airline with ID %s found'), $apid)); |
PoC
Visit https://openflights.org/php/routes.php?apid=%3Cimg%20src%20onerror=%22alert(%27xss%27)%22%3E
Impact
Remote attackers can inject arbitrary JavaScript on the php/routes.php webpage by fooling a victim into visiting a malicious link.
Summary
Reflected XSS vulnerability in
php/routes.phpallows remote attackers to inject arbitrary JavaScript or HTML via theapidparameter.Details
openflights/php/routes.php
Line 8 in 2d76df9
openflights/php/routes.php
Line 93 in 2d76df9
openflights/php/routes.php
Line 134 in 2d76df9
PoC
Visit https://openflights.org/php/routes.php?apid=%3Cimg%20src%20onerror=%22alert(%27xss%27)%22%3E
Impact
Remote attackers can inject arbitrary JavaScript on the
php/routes.phpwebpage by fooling a victim into visiting a malicious link.