EmbedThis GoAhead Web Server HTML Injection Vulnerability

A vulnerability allowing HTML injection has been identified in EmbedThis GoAhead Web Server version 2.5. This issue arises in the 'goform/formTest' endpoint, where inadequate input validation of the 'name' parameter allows for the injection of HTML content. Exploiting this vulnerability could enable an attacker to execute scripts or HTML within the context of the affected website.

Impact

Exploitation of this vulnerability allows for HTML injection, which could be used to execute scripts in the context of the user’s browser.

Reproduction

To reproduce this vulnerability, send a request to the 'goform/formTest' endpoint with the 'name' parameter containing injected HTML, such as a header tag. The server's response will render the injected HTML, demonstrating the successful exploitation of the vulnerability.