Descreekert wx-discuz Cross-Site Scripting Vulnerability in wx.php

A cross-site scripting (XSS) vulnerability has been identified in Descreekert wx-discuz versions up to commit 12bd4745c63ec203cb32119bf77ead4a923bf277. The issue arises in the 'validToken' function of the 'wx.php' file, where the 'echostr' parameter is not properly sanitized before being output, allowing for the injection of malicious scripts. This vulnerability can be exploited remotely, but requires user interaction.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to 'wx.php' with the 'echostr' parameter containing the injected script. The 'validToken' function will echo the 'echostr' value without proper sanitization, leading to script execution in the user's browser.