CVE-2021-40926

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in the demos/demo.mysqli.php file of the getID3 library (versions 1.X and v2.0.0-beta). The showtagfiles parameter is not properly sanitized before being rendered, allowing an attacker to inject arbitrary web script or HTML. This affects all installations using the demo script with default configurations [1][3].

Exploitation

An attacker can craft a malicious URL containing the payload in the showtagfiles parameter and trick a victim into clicking it. No authentication is required to access the demo script if it is exposed on a web server. The payload is reflected in the response and executed in the victim's browser context [2][3].

Impact

Successful exploitation leads to arbitrary JavaScript execution in the context of the affected origin, enabling actions such as session hijacking, credential theft, or defacement. The attacker does not gain file read/write or server-side code execution, but achieves standard client-side XSS impact [3].

Mitigation

The vulnerability is fixed in getID3 version 1.9.21, released September 22, 2021, which includes a proper sanitization of the showtagfiles parameter [4]. Users should update to at least version 1.9.21 or later. As a workaround, restrict access to the demo script (e.g., remove or protect demos/demo.mysqli.php) until an upgrade can be performed [2][4].