MiniGal Nano Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in MiniGal Nano versions through 0.3.5. The issue resides in index.php, where the dir parameter is processed. The application fails to properly encode user-supplied input before embedding it into an error message, allowing attackers to inject HTML or JavaScript that is reflected back to the user. Exploitation of this vulnerability could result in the execution of arbitrary scripts in the context of the user's browser, within the vulnerable application.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute scripts in the context of the victim's browser session.