CVE-2018-16361

Vulnerability

XBTIT version 2.5.4 contains a reflected cross-site scripting (XSS) vulnerability in news.php. The id parameter is not properly sanitized, allowing an attacker to inject arbitrary HTML and JavaScript code. The anti-XSS mechanism in includes/crk_protection.php can be bypassed using a technique involving String.replace and eval as described in [1].

Exploitation

An attacker can craft a malicious link with a payload in the id parameter and trick an authenticated user into clicking it. The payload can bypass the anti-XSS filter by splitting dangerous strings with tildes and reconstructing them using JavaScript's String.replace and eval [1]. No special network position or authentication is required; the attacker only needs to convince a user to visit the crafted URL.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to theft of session cookies, account compromise, or other malicious actions performed on behalf of the victim. The attacker gains the same privileges as the victim user.

Mitigation

No official fix has been disclosed in the available references [1]. Administrators are advised to apply proper input validation and output encoding for the id parameter in news.php, or monitor for updates from the vendor. As of the publication date, no patched version has been released.