FlatPress Media Manager Plugin panel.mediamanager.file.php main cross site scripting

Vulnerability

A cross-site scripting (XSS) vulnerability exists in FlatPress, affecting the Media Manager plugin. The issue resides in the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php, specifically in the main function. The mm-newgallery-name argument is not properly sanitized, allowing an attacker to inject malicious script code [1], [2]. This vulnerability affects versions prior to the commit d3f329496536dc99f9707f2f295d571d65a496f5 [1].

Exploitation

An attacker can exploit this vulnerability remotely without requiring authentication [1], [2]. The attack involves crafting a malicious mm-newgallery-name parameter containing JavaScript code (e.g., ``). When the vulnerable panel is loaded or the injected data is rendered, the script executes in the context of the administrator or any user visiting the affected page [2]. The issue was reported as a possible XSS in the Media Manager plugin [2].

Impact

Successful exploitation leads to stored XSS, enabling an attacker to execute arbitrary JavaScript in the browser of any user accessing the affected functionality. This could result in session hijacking, defacement, or theft of sensitive information within the FlatPress admin panel [1], [2]. The vulnerability is classified as problematic with a potential for moderate impact on confidentiality and integrity.

Mitigation

The fix is provided in commit d3f329496536dc99f9707f2f295d571d65a496f5 [1]. Users should apply this patch or update to a version that includes it. As of the publication date (2022-12-27), no CISA KEV listing has been reported; the vendor recommends patching [1], [2].