Bootstrap Multiselect Cross-Site Scripting Vulnerability in post.php

A reflective cross-site scripting vulnerability has been identified in Bootstrap Multiselect version 1.1.2. The issue arises in post.php, where a PHP script echoes arbitrary POST data. If this behavior is replicated in a live application, it could be exploited through cross-site request forgery.

Impact

Exploitation allows for reflective cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to 'post.php' with a 'canary' parameter containing a script tag, such as one that triggers an alert. The response will reflect the injected script, demonstrating the cross-site scripting vulnerability.

Remediation

Developers are advised to use only the necessary components of Bootstrap Multiselect in production applications.