GeSHi Cross-Site Scripting Vulnerability in CSS Handler Component

A cross-site scripting (XSS) vulnerability has been identified in GeSHi versions through 1.0.9.1. The issue resides in the CSS Handler component, specifically within the 'get_var' function of the 'contrib/cssgen.php' file. This vulnerability allows remote attackers to inject malicious HTML, which is executed when the affected page is viewed. The flaw impacts systems that use Composer to install the GeSHi library and have not removed the 'contrib' directory. Affected applications may include Dokuwiki, Mambo, phpBB, and WikkaWiki.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to 'contrib/cssgen.php' with crafted 'default-styles', 'keywords-1', 'comments', and 'escaped-chars' parameters containing malicious JavaScript, such as a script tag alerting the document cookie.