Description

A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reportico_criteria parameter in conjunction with the execute_mode=CRITERIA parameter of run.php.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-18T18:18:20.143Z",
  "pubdate": "2026-08-18T18:18:20.143Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability has been identified in reportico-web versions 8.1.0 and prior. This security flaw enables remote attackers to inject and execute arbitrary JavaScript code within the context of a victim's web browser session. The vulnerability resides in the handling of HTTP request parameters processed by run.php. Specifically, exploitation requires the inclusion of a malicious payload within the reportico_criteria parameter when combined with the execute_mode=CRITERIA parameter. The risk implication of this vulnerability is significant, as successful exploitation allows malicious actors to perform actions on behalf of the user, potentially compromising session tokens, sensitive data, or interacting with the underlying web application with the privileges of the victim. Attackers do not require prior authentication to the application, provided they can successfully induce a user to interact with a crafted URL. Remediation requires implementing proper input sanitization and contextual output encoding within the affected script to neutralize untrusted data before rendering it in the response.",
  "technicalDetails": "The vulnerability is classified as a reflected cross-site scripting (XSS) flaw, stemming from the unsafe handling of user-supplied input within the PHP-based web application. The vulnerable component is located in run.php, which processes parameters submitted via HTTP GET or POST requests without performing adequate validation, sanitization, or output encoding.\nThe root cause of the vulnerability lies in the direct reflection of input values passed via the reportico_criteria parameter back into the Document Object Model (DOM) of the generated Hypertext Markup Language (HTML) response. When the application processes a request containing execute_mode=CRITERIA, it dynamically generates interface elements or error messages that incorporate the unescaped contents of the reportico_criteria parameter.\nThe attack flow proceeds as follows: First, a remote attacker crafts a malicious Uniform Resource Locator (URL) targeting the vulnerable run.php endpoint. This URL embeds a JavaScript payload designed to execute within the victim's browser, typically formatted within the reportico_criteria parameter alongside the mandatory execute_mode=CRITERIA parameter. Second, the attacker induces a targeted user to click the crafted link or visit the malicious URL via social engineering vectors such as phishing emails, malicious advertisements, or compromised websites. Third, the victim's browser issues an HTTP request to the remote server hosting the vulnerable reportico-web installation. Fourth, the server processes the request, executes run.php, and inadvertently includes the unescaped malicious payload in the HTTP response body. Finally, the victim's browser parses the incoming response, interprets the payload as legitimate script code, and executes the arbitrary JavaScript within the security context of the vulnerable origin.\nThe affected versions include reportico-web 8.1.0 and all prior versions. The vulnerability exhibits network exposure via HTTP and HTTPS protocols, requiring network accessibility to the target web application. Exploitation requires no prior authentication or administrative privileges on the part of the attacker, though it requires user interaction to successfully trigger the reflection in the browser. The post-exploitation impact includes session hijacking, credential theft, DOM manipulation, redirection to malicious external sites, and the execution of unauthorized actions within the scope of the authenticated user's session."
}