CVE-2024-25412

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the Flatpress v1.3 installer. The email field on the setup page does not properly sanitize user input, allowing an attacker to inject arbitrary HTML or JavaScript. This affects FlatPress versions up to and including 1.2.1, with the issue present in the 1.3 release candidate that was intended to fix it. The vulnerable code path is reachable during the initial installation wizard (setup.php).

Exploitation

An attacker can exploit this vulnerability by simply accessing the Flatpress setup page (e.g., http://127.0.0.1/setup.php) and entering a crafted payload into the email field. No authentication or special network position is required; the attacker only needs to be able to load the setup page. The proof-of-concept payload "> or "> causes immediate script execution when the page processes the input and renders it without escaping [1].

Impact

Successful exploitation leads to arbitrary JavaScript execution in the context of the victim's browser session. This can result in session hijacking, defacement, or redirection to malicious sites. Since the XSS occurs during the installation process, the impact is limited to users who are in the process of setting up Flatpress, which could include administrators on a fresh installation.

Mitigation

The vendor has acknowledged the issue and a fix is planned for FlatPress version 1.3, but as of the publication date no patched release is available [1]. Users are advised to avoid using the affected installer in untrusted environments or to implement a web application firewall (WAF) rule to block the malicious payload patterns. For existing installations, manual sanitization of the email field in the installer source code may be considered until the official fix is released.