Описание
Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter
Withdrawn Advisory
This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references. For more information, see https://github.com/github/advisory-database/pull/5862.
Original Description
A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2020-15943
- https://nvd.nist.gov/vuln/detail/CVE-2025-45406
- https://github.com/codeigniter4/CodeIgniter4/blob/v4.6.2/system/Debug/Toolbar.php#L496
- https://github.com/codeigniter4/framework/blob/v4.6.2/system/Debug/Toolbar.php#L496
- https://medium.com/@talktoshweta0/when-debugging-bites-back-exposing-a-persistent-xss-in-codeigniter4-c9caf804a190
- https://www.exploit-db.com/exploits/50556
Пакеты
codeigniter4/framework
<= 4.6.2
Отсутствует
Связанные уязвимости
A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter. NOTE: this is disputed by the Supplier because attackers cannot influence the value of debugbar_time, and because debugbar-related data is automatically escaped by the CodeIgniter Parser class.
A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6 ...