PHPOffice PhpSpreadsheet Cross-Site Scripting Vulnerability in Convert-Online.php

A cross-site scripting (XSS) vulnerability has been identified in the PHPOffice PhpSpreadsheet library, specifically in versions 3.6.0 prior to 3.7.0, 2.1.5, and 2.3.4. The issue arises from a lack of input sanitization in the 'Convert-Online.php' sample file, located within the 'Engineering' folder. This oversight allows attackers to inject malicious JavaScript that is executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for unauthorized reflected cross-site scripting, where an attacker can execute arbitrary JavaScript in the victim's browser.

Reproduction

To reproduce this vulnerability, upload a malicious image to a server that hosts the vulnerable PhpSpreadsheet version. Then, use the 'Convert-Online.php' script to send a POST request that includes the image as a quantity parameter. The server will respond by reflecting the image back without proper sanitization, triggering the XSS payload.

Remediation

Users can update to PhpSpreadsheet versions 3.7.0, 2.3.5, 2.1.6, or 1.29.7, all of which include the necessary patch to address this vulnerability.