Open Source Social Network Cross-Site Scripting Vulnerability in Version 8.6

A reflected cross-site scripting vulnerability has been identified in Open Source Social Network (OSSN) version 8.6. This issue occurs in the 'u/administrator/friends' endpoint, where attackers can inject malicious scripts through an arbitrarily supplied URL parameter. The vulnerability allows for virtual defacement of the website, execution of actions on behalf of the user, redirection to competing sites, and interception of the user's session cookie.

Impact

Exploitation of this vulnerability could lead to cross-site scripting, allowing for the injection of malicious scripts that could be executed in the context of the user's browser.

Remediation

Users can upgrade to OSSN version 8.7 or above to address this vulnerability.