Zucchetti Ad Hoc Revolution Cross-Site Scripting Vulnerability
Vulnerability
A cross-site scripting (XSS) vulnerability has been identified in Zucchetti Ad Hoc Revolution versions through 4.1. This vulnerability allows remote, unauthenticated attackers to inject arbitrary JavaScript. The issue arises from the unsanitized reflection of the pHtmlSource parameter in the /ahrw/jsp/gsfr_feditorHTML.jsp endpoint, enabling client-side script execution.
Impact
Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.
Remediation
Zucchetti has released a fix for this vulnerability. Users are advised to update to the latest version.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.