Cross-site Scripting (XSS) in bigtreecms 4.2.22

[l1nk3rlin]

Cross-site Scripting (XSS) in bigtreecms 4.2.22

The vulnerability is in /core/inc/lib/less.php/test/index.php。

POC：
localhost/BigTree-CMS/core/inc/lib/less.php/test/index.php?dir=aaa"><script>alert(1)</script>&file=charsets

thank you~

[timbuckingham]

This is a submodule of https://github.com/oyejorge/less.php -- I would report the issue there.

[fgeek]

@timbuckingham check the comment in oyejorge/less.php#361

[timbuckingham]

I've adjusted the build scripts for BigTree 4.2.x to explicitly delete /core/inc/lib/less.php/test when building a production zip file (so it should be removed in the next 4.2.x release). BigTree 4.3.x already moved to using composer to install the LESS library so it should be fixed there. Thanks for the follow up!

[fgeek]

Great, thanks! I think that this issue report can be closed.