CVE-2018-12290

Vulnerability

The Yii2-StateMachine extension versions 2.x.x for the Yii2 framework contains a cross-site scripting (XSS) vulnerability. The role parameter is not properly sanitized, allowing injection of arbitrary JavaScript code [2].

Exploitation

An attacker can exploit this by sending a GET request with a crafted role parameter containing malicious script, e.g., ?role=guest'%22()%26%25 [2]. No special privileges are required as the parameter is user-controlled.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, leading to information disclosure, session hijacking, or other client-side attacks [2].

Mitigation

No official fix was disclosed in the available references. Users should apply input validation and output encoding to the role parameter, or disable the extension if not needed [2].