Luna Imaging Cross-Site Scripting Vulnerability in Versions Prior to 7.5.5.6

A cross-site scripting (XSS) vulnerability has been identified in Luna Imaging versions prior to 7.5.5.6. The issue arises in an unknown function of the file '/luna/servlet/view/search', where the manipulation of the 'q' argument allows for the injection of malicious scripts. This vulnerability can be exploited remotely and does not require authentication, although it does necessitate user interaction from the victim.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a GET request to '/luna/servlet/view/search' with a crafted 'q' parameter that includes a script payload, such as a script tag containing JavaScript code, such as an alert. This will trigger the cross-site scripting vulnerability by executing the injected script in the user's browser.