PhpSpreadsheet Unauthorized Reflected Cross-Site Scripting Vulnerability in Accounting.php

A reflected cross-site scripting vulnerability has been identified in PhpSpreadsheet versions 3.6.0, 2.3.4, 2.1.5, and prior to 1.29.7. The issue resides in the Accounting.php file, specifically within the NumberFormat Wizard sample. This vulnerability allows an attacker to inject malicious scripts that are executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the victim's browser, potentially leading to session hijacking or other malicious actions.

Reproduction

To reproduce this vulnerability, send a POST request to the vulnerable Accounting.php script with a crafted currency parameter that includes JavaScript payload, such as an image tag with an 'onerror' event. This can be done manually or automated with a tool like Burp Suite.

Remediation

Users can update to PhpSpreadsheet versions 3.7.0, 2.3.5, 2.1.6, or 1.29.7, all of which include a patch for this vulnerability.