YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
SummaryReflected XSS has been detected in the file upload form. Vulnerability can be exploited without authenticationThis Proof of Concept has been performed using the followings:YesWiki v4.5.3 (doryphore-dev branch)Docker environnment (docker/docker-compose.yml)Vulnerable codeThe vulnerability is located in the [file](https://github.com/YesWiki/yeswiki/blob/6894234bbde6ab168bf4253f9a581bd24bf53766/tools/attach/libs/attach.lib.php#L724-L735)PoCYou need to send a request to endpoint and abusing the `file` parameter, we can successfully obtain client side javascript executionGet a response
<img width="853" alt="Снимок экрана 2025-04-11 в 02 04 55" src="https://github.com/user-attachments/assets/b923f563-ead5-494c-8fbd-1c3b11635820" />ImpactThis vulnerability allows any malicious unauthenticated user to create a link that can be clicked on in the victim context to perform arbitrary actions