STVS ProVision Cross-Site Scripting Vulnerability in the Files Parameter

A cross-site scripting vulnerability has been identified in STVS ProVision version 5.9.10, as well as several earlier versions. The issue arises from improper validation of user input in the 'files' POST parameter, allowing authenticated attackers to inject arbitrary HTML. This unvalidated input can be exploited to execute malicious scripts in the context of the user's browser session on the affected site.

Impact

Exploitation of this vulnerability allows for authenticated reflected cross-site scripting, where injected scripts are executed in the context of the user's session on the affected site.

Reproduction

To reproduce this vulnerability, an authenticated user can send a POST request to the '/archive/download' endpoint with a payload in the 'files' parameter that includes a script tag. Once the request is processed, the injected script will be executed in the user's browser.