userSpice Cross-Site Scripting Vulnerability via X-Forwarded-For Header

A cross-site scripting (XSS) vulnerability has been identified in userSpice version 4.3.24. This issue allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header. By sending crafted requests to the backup.php endpoint, attackers can include XSS payloads in the X-Forwarded-For header. These payloads are executed when administrators access the audit log page.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the backup.php endpoint with an X-Forwarded-For header containing a script payload. When an administrator views the audit log page, the injected script will execute.