GestioIP Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in GestioIP version 3.5.7. The issue arises in the 'ip_import_acl_csv' request, where improperly formatted file uploads can result in the content being reflected in the HTML response. This flaw allows attackers to execute malicious scripts or exfiltrate data.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, upload a file with an improper format using the 'ip_import_acl_csv' request. The uploaded content will be reflected in the HTML response, creating an opportunity to execute malicious scripts or steal data.