[FD] CVE-2024-30929: XSS Vulnerability in DerbyNet v9.0 via 'back' Parameter in playlist.php

[Valentin Lobstein via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

CVE ID: CVE-2024-30929

Description:
A Cross-Site Scripting (XSS) vulnerability has been found in DerbyNet version 
9.0, affecting the `playlist.php` component. This issue allows remote attackers 
to execute arbitrary code by exploiting the `back` parameter. The application 
does not properly sanitize the `back` parameter before it is rendered on the 
page, thereby allowing the injection and execution of arbitrary JavaScript code.

Vulnerability Type: Cross-Site Scripting (XSS)

Vendor of Product: DerbyNet - Available on GitHub: 
https://github.com/jeffpiazza/derbynet

Affected Product Code Base: DerbyNet - v9.0

Affected Component: playlist.php

Attack Type: Remote

Impact: Code execution

Attack Vectors:
The vulnerability can be exploited by crafting a URL that includes malicious 
JavaScript code as part of the `back` parameter. An example of such a URL is:
- http://127.0.0.1:8000/playlist.php?back=";><script>alert(1)</script>

This example demonstrates how an attacker could inject and execute JavaScript 
within the context of the webpage, leading to potential security risks such as 
session hijacking, phishing, or unauthorized actions performed on behalf of the 
user.

Discoverer: Valentin Lobstein

References:
- Official website: http://derbynet.com
- Source code on GitHub: https://github.com/jeffpiazza/derbynet
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/