Description

A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the component JSON-LD Theme Handler. The manipulation of the argument Search leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.1.1 is able to mitigate this issue. The identifier of the patch is 67abfd864a15d169a78429f3290c91cb3b93e849. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-31T09:17:04.250Z",
  "pubdate": "2026-08-31T09:17:04.250Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability exists within the JSON-LD Theme Handler component of GEOFlow versions up to 2.1.0.\nThe vulnerability originates from the improper neutralization of user-supplied input within the 'Search' argument processed by the application.\nSuccessful exploitation allows an unauthenticated, remote attacker to execute arbitrary JavaScript within the context of a victim's browser session.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of the user, and unauthorized data exfiltration.\nThis vulnerability is classified as critical due to the ease of remote exploitation and the existence of public exploit code.\nOrganizations using affected versions are at significant risk of malicious activity and should prioritize the application of the official security patch.",
  "technicalDetails": "The vulnerability is located within the 'app/Http/Controllers/Site/HomeController.php' file, specifically affecting the JSON-LD Theme Handler component of the GEOFlow application.\nThe root cause is an inadequate sanitization or output encoding mechanism for the 'Search' HTTP parameter. When the application processes this input, it fails to properly escape special characters before embedding the data into the HTML document structure.\nAn attacker can exploit this by crafting a malicious URL containing a JavaScript payload within the 'Search' argument. When a victim accesses this crafted link, the application reflects the payload directly into the response body.\nThe browser interprets the reflected payload as legitimate script content, executing it within the security context of the vulnerable site's origin.\nSince the attack is reflected, no specific privileges or authentication are required to trigger the execution, and it can be launched remotely against any user who can be coerced into clicking the link.\nThe vulnerability allows for the bypass of standard security controls that rely on user-side input validation, as the malicious script executes after the server has processed the initial request.\nThe post-exploitation impact includes the ability to steal session cookies (if 'HttpOnly' flags are absent), modify the DOM structure of the page, redirect users to malicious domains, or perform unauthorized API requests under the authenticated user's session token.\nThis vulnerability was formally addressed in commit '67abfd864a15d169a78429f3290c91cb3b93e849', which provides the necessary remediation logic to properly sanitize the input before rendering.\nThe affected versions include all releases of GEOFlow up to and including 2.1.0. Upgrading to version 2.1.1 is required to neutralize the threat."
}