cdevroe unmark Cross-Site Scripting Vulnerability in searchform.php

A cross-site scripting (XSS) vulnerability has been identified in cdevroe unmark versions through 1.9.3. The issue arises in the file application/views/layouts/topbar/searchform.php, where user-supplied input in the query parameter 'q' is not properly validated or encoded before being reflected in the HTML. This flaw allows remote attackers to inject malicious scripts that are executed in the context of the user's browser, potentially hijacking sessions or stealing cookies.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's session.

Reproduction

To reproduce this vulnerability, send a GET request to the /marks/search endpoint with a crafted query parameter 'q' that includes JavaScript payloads, such as a script tag or an image tag with an error event. The injected script will execute in the user's browser, demonstrating the cross-site scripting vulnerability.