VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Mar 23, 2017· Updated May 13, 2026

CVE-2017-7251

CVE-2017-7251

Description

A Cross-Site Scripting (XSS) was discovered in pi-engine/pi 2.5.0. The vulnerability exists due to insufficient filtration of user-supplied data (preview) passed to the "pi-develop/www/script/editor/markitup/preview/markdown.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pi/piPackagist
< 2.6.0-alpha12.6.0-alpha1

Affected products

1
  • Piengine/Pi
    cpe:2.3:a:piengine:pi:*:*:*:*:*:*:*:*
    Range: <=2.5.0

Patches

1
557cd05b21b4

Fix XSS problem https://github.com/pi-engine/pi/issues/1523

https://github.com/pi-engine/pivoltanMar 21, 2017via ghsa
commit
1 file changed · +6 −0
  • www/script/editor/markitup/preview/markdown.php+6 −0 modified
    @@ -7,7 +7,13 @@
  * @license         http://pialog.org/license.txt BSD 3-Clause License
  */
 
+// Pi boot with no engine bootup: current file is located in www/script/...
+$boot = dirname(dirname(dirname(dirname(dirname($_SERVER['SCRIPT_FILENAME']))))) . '/boot.php';
+include $boot;
+
 $content = $_POST['preview'];
+$content = Pi::service('security')->filter($content);
+$content = _escape($content);
 
 if (class_exists('MarkdownDocument')) {
     $markdown = MarkdownDocument::createFromString($content);

Vulnerability mechanics

Synthesis attempt was rejected by the grounding validator. Re-run pending.

References

6

News mentions

0

No linked articles in our index yet.