OpenMage Magento Long Term Support Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in OpenMage Magento Long Term Support (LTS) versions through 20.17.0. The issue occurs in the admin panel under 'System -> Import/Export -> Dataflow - Profiles'.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into the admin panel and navigate to 'System -> Import/Export -> Dataflow - Profiles'. Select 'Import Customers' and upload a file. After uploading, go to 'Run profile', select the uploaded file, and click 'Run in Popup'. The filename is reflected in the HTML, allowing for the injection of HTML tags or scripts, which are executed when the injected content is processed.

Remediation

Users can upgrade to OpenMage Magento LTS version 20.18.0 or later to address this vulnerability.