High-Tech Bridge Security Research Lab discovered vulnerability in Offiria, which can be exploited to perform Cross-Site Scripting (XSS) attacks against users of vulnerable application.
The vulnerability exists due to insufficient sanitisation of user-supplied data in URI after “/installer/index.php” script that is not removed from the system by default. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
The following exploitation example displays “immuniweb” word:
http://[host]/installer/index.php/%22onmouseover%3d%22alert%28%27immuniweb%2 7%29;%22%3d%22%3E