XSS vulnerability in display.php

[everping]

Summary

The parameter project is not sanitized, so attackers can poison this parameter and then create a reflected XSS attack.

PoC

http://domain.tld/display.php?browse[]=all&project=1">test</a><script>alert(123)</script>&select=desk&_=1555500329996

Details

The flaw exists since $project was assigned to a GET parameter without sanitizing

i-librarian/display.php

Line 15 in 07a2668

$project = $_GET['project'];

then, $project was printed without escaping

i-librarian/display.php

Line 326 in 07a2668

print '<a href="rss.php?project=' . $project . '" target="_blank" id="rss-link">&nbsp;<i class="fa fa-rss"></i> Project RSS</a>';

[mkucej]

Thank you. This will be fixed in the next version.

[everping]

@mkucej Can you assign this flaw a CVE?