SVXportal Reflected Cross-Site Scripting Vulnerability in Admin Log PHP

A reflected cross-site scripting vulnerability has been identified in SVXportal versions through 2.5. The issue resides in the admin/log.php file, specifically within the search query parameter. When an authenticated administrator accesses a specially crafted URL, the application fails to properly sanitize the parameter value before embedding it into an HTML input value attribute. This oversight allows the execution of attacker-supplied JavaScript in the administrator's browser, potentially leading to session theft, unauthorized administrative actions, or other browser-based compromises involving the admin user.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute malicious scripts in the context of the victim's browser session.