Xiaopi Panel WAF Firewall Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been identified in Xiaopi Panel version 1.0.0, specifically within the WAF Firewall component. The issue arises in the '/demo.php' file, where the 'param' argument is manipulated, allowing for the injection of malicious scripts. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the '/demo.php' file with a crafted 'param' argument that includes the desired script injection. The WAF firewall's inadequate input filtering will allow the script to be executed.