FlatPress Setup main.lib.php cross site scripting

Vulnerability

A cross-site scripting (XSS) vulnerability exists in FlatPress prior to the patch commit 5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1. The issue is located in the file setup/lib/main.lib.php within the validate() function. User-supplied input fields such as fpuser (username), email, and www (website) are not sanitized before being stored. This allows an attacker to inject arbitrary HTML and JavaScript code during the setup process [1], [2].

Exploitation

An attacker can remotely trigger the vulnerability during the FlatPress installation wizard by submitting malicious payloads in the username, email, or website fields. No prior authentication or special privileges are required, as the setup page is typically accessible without login. The injected script will be stored in the configuration and executed when an administrator views the affected page [2].

Impact

Successful exploitation leads to stored cross-site scripting. An attacker can execute arbitrary JavaScript in the context of the FlatPress administration interface, potentially allowing session hijacking, credential theft, or other malicious actions. The impact is limited to the scope of the admin session but could lead to full compromise of the FlatPress installation [1], [2].

Mitigation

The vulnerability is fixed in commit 5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1 which adds strip_tags() sanitization to the affected input fields [1]. Users should apply the patch immediately by updating to the latest version of FlatPress that includes this commit. No workaround is available if the patch cannot be applied; users should avoid the setup page if they are not actively configuring the site [2].