code-projects Online Reviewer System btn_functions.php クロスサイトスクリプティング

The XSS vulnerability in Online Reviewer System 1.0 allows an attacker to inject arbitrary JavaScript code into the application. This code will then be executed in the context of any user who views the affected page. An attacker could leverage this to steal session cookies, redirect users to malicious websites, or deface the application. The impact is particularly severe if the application handles sensitive user data or is integrated with other systems. While the CVSS score is LOW, the potential for user compromise remains significant, especially in environments with limited security controls.

Organizations using Online Reviewer System 1.0, particularly those with publicly accessible instances or those that handle sensitive user data, are at risk. Shared hosting environments where multiple users share the same server and application instance are also at increased risk, as a compromise of one user could potentially impact others.

• php / generic web:

grep -r 'firstname = $_POST' /system/system/admins/manage/users/btn_functions.php

• generic web:

curl -I http://your-server.com/system/system/admins/manage/users/btn_functions.php?firstname=<script>alert(1)</script>

1. 2026-02-09Disclosure

   disclosure

2. 2026-02-09PoC

   poc

1. 予約済み2026-02-08
2. 公開日2026-02-09
3. 更新日2026-02-23
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-2222 is to upgrade to a patched version of Online Reviewer System. If upgrading immediately is not possible, consider implementing input validation and output encoding on the 'firstname' parameter in /system/system/admins/manage/users/btn_functions.php. This can help prevent malicious scripts from being injected. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide an additional layer of protection. Regularly review and update security policies and procedures to minimize the risk of XSS vulnerabilities.