LibreNMS Reflected Cross-Site Scripting Vulnerability in report_this Function

A reflected cross-site scripting vulnerability has been identified in LibreNMS versions prior to 25.7.0. The issue arises in the report_this function within the includes/functions.php file, where improper filtering allows the project_issues parameter to execute malicious scripts. This vulnerability has been patched in version 25.7.0.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a GET request with the project_issues parameter set to a JavaScript URL, such as 'javascript:alert(document.cookie)'. This will trigger the cross-site scripting vulnerability by executing the injected script in the user's browser.

Remediation

Users can upgrade to LibreNMS version 25.7.0 or later to address this vulnerability.