diskover-web Stored Cross-Site Scripting Vulnerability in Administrative Settings

A stored cross-site scripting vulnerability has been identified in diskover-web version 2.3.0 Community Edition. This issue resides within the administrative settings interface, where several configuration fields fail to properly sanitize user input. Affected fields include ES_HOST, ES_INDEXREFRESH, ES_PORT, ES_SCROLLSIZE, ES_TRANSLOGSIZE, ES_TRANSLOGSYNCINT, EXCLUDES_FILES, FILE_TYPES[], INCLUDES_DIRS, INCLUDES_FILES, and TIMEZONE. Malicious scripts injected through these parameters are saved in the application and executed when an administrator views or modifies the settings page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the settings.

Reproduction

To reproduce this vulnerability, navigate to the administrative settings interface of diskover-web v2.3.0 Community Edition. Inject a script payload into one of the vulnerable fields, such as ES_HOST or TIMEZONE. Once the payload is submitted, it will be executed when the settings page is accessed again.