julmud phpDVDProfiler Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in julmud/phpDVDProfiler, specifically in versions v_20230807 prior to v_20250511. The issue arises in the search function, where user input is not properly sanitized, allowing for the injection of malicious scripts. This vulnerability affects both the gallery and the main screen.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, navigate to the search function in either the gallery or the main screen. Input a search term that includes unsanitized HTML, such as a script tag followed by an image tag with an error event. This will trigger the cross-site scripting vulnerability by executing the injected script.

Remediation

Users can upgrade to version v_20250511, which includes a patch for this vulnerability.