Description

A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the execute_mode=PREPARE parameter of run.php.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-18T17:16:59.080Z",
  "pubdate": "2026-08-18T17:16:59.080Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability has been identified in reportico-web versions 8.1.0 and prior. This security flaw enables remote, unauthenticated attackers to execute arbitrary JavaScript code within the context of a victim's web browser session. The vulnerability resides in the application's handling of user-supplied input parameters processed by run.php. Successful exploitation requires a user to interact with a maliciously crafted URL or input vector, potentially leading to unauthorized actions, session hijacking, or the extraction of sensitive information accessible within the browser. The risk profile is characterized by remote network exposure, lack of privilege requirements for the attacker, and dependence on user interaction to achieve payload execution.",
  "technicalDetails": "The vulnerability is classified as a reflected cross-site scripting (XSS) defect localized within the run.php script of reportico-web. The root cause stems from the application's failure to adequately sanitize, validate, or encode user-supplied input prior to reflecting it back in the HTTP response. Specifically, the attack vector is exposed when an attacker includes a malicious script payload within the loadTemplate parameter, combined simultaneously with the execute_mode=PREPARE parameter.\nFrom an attack flow perspective, an adversary crafts a malicious URL containing the exploit payload targeted at the vulnerable run.php endpoint. The network exposure is remote, as the application is typically accessible over HTTP or HTTPS via standard web browsers. No prior authentication or specific privilege level is required by the attacker to initiate the request, although the execution of the attack payload strictly depends on social engineering a legitimate user into clicking or navigating to the malicious link.\nWhen the victim accesses the crafted URL, the server processes the request involving the unsanitized loadTemplate parameter under the PREPARE execution mode. The application subsequently embeds the malicious input directly into the generated HTML output without proper contextual output encoding. Upon receiving the response, the victim's web browser parses and executes the injected JavaScript payload within the security context of the vulnerable origin. This grants the attacker the ability to manipulate the Document Object Model (DOM), access session cookies, steal authentication tokens, or perform unauthorized state-changing actions on behalf of the authenticated user."
}