Zucchetti Ad Hoc Infinity Cross-Site Scripting Vulnerability
Vulnerability
A cross-site scripting (XSS) vulnerability has been identified in Zucchetti Ad Hoc Infinity versions through 4.2. This vulnerability allows remote, unauthenticated attackers to inject arbitrary JavaScript. The issue arises in the /ahi/jsp/gsfr_feditorHTML.jsp?pHtmlSource endpoint, where the pHtmlSource parameter is not properly sanitized, enabling the reflection of malicious scripts.
Impact
Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.
Remediation
Zucchetti has released a fix for this vulnerability. Details on how to apply the update can be found on the Zucchetti Store.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.