Yahei-PHP Prober Remote HTML Injection Vulnerability Allowing Cross-Site Scripting

A remote HTML injection vulnerability has been identified in Yahei-PHP Prober version 0.4.7. This vulnerability allows attackers to execute arbitrary HTML code by injecting it into the 'speed' GET parameter of the 'prober.php' script. The injected HTML is executed in the context of the user's browser session on the affected site, leading to cross-site scripting (XSS).

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser session on the affected site.

Reproduction

To reproduce this vulnerability, send a request to 'prober.php' with a crafted 'speed' parameter that includes the desired HTML injection, such as a marquee tag. This can be done using a web browser or a tool like curl or Postman.