CVE-2019-25262

Vulnerability

CVE-2019-25262 describes a stored cross-site scripting (XSS) vulnerability in the elinicksic Razgover chat application, specifically in the file Chattify/send.php. The msg parameter is not sanitized before being stored and later rendered in the chat output, allowing an attacker to inject arbitrary HTML or JavaScript. The patch commit 995dd89d0e3ec5522966724be23a5d58ca1bdac3 shows that the fix also adds authentication checks and uses jQuery to load messages via load.php, which likely sanitizes output [1].

Exploitation

An attacker can send a crafted message containing malicious script code via the msg parameter to send.php. The attack is performed remotely and does not require authentication, as the original code lacked session checks. The injected script executes in the context of any user viewing the chat messages, leading to persistent XSS [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browserside scripts in the context of other users' sessions. This can lead to session hijacking, defacement, or theft of sensitive information. The CVSS v3 score is 3.5 (Low) due to the requirement for user interaction and the limited scope of impact [1].

Mitigation

The maintainer has provided a patch in commit 995dd89d0e3ec5522966724be23a5d58ca1bdac3. However, the repository was archived in August 2021 and is now read-only, indicating the product is no longer supported. Users are advised to apply the patch or migrate to an alternative solution [1].