Description

A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 1.2.1.20210731_beta is able to address this issue. The name of the patch is b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-07T02:17:21.247Z",
  "pubdate": "2026-09-07T02:17:21.247Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified in the User Controller of FastAdmin, affecting versions up to 1.2.0.20210401_beta.\nThe vulnerability resides in the improper handling of user-supplied input within the 'url' argument during the register/login process.\nSuccessful exploitation allows a remote, unauthenticated attacker to execute arbitrary JavaScript in the context of the victim's browser session.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of the user, and the exfiltration of sensitive information.\nThe vulnerability is publicly disclosed, necessitating immediate remediation to prevent exploitation in production environments.\nAffected systems are urged to upgrade to the specified patched version to mitigate the risk of compromise.",
  "technicalDetails": "The vulnerability exists in the 'application/index/controller/User.php' file, specifically within the register/login functionality of the User Controller.\nThe root cause is the inadequate sanitization and validation of the 'url' parameter passed to the controller. When a user navigates to the login or register page, the application accepts a 'url' parameter intended to redirect the user after a successful action.\nDue to the failure to neutralize dangerous characters or validate the structure of the input, an attacker can supply a crafted URL containing a 'javascript:' pseudo-protocol or malicious payload.\nWhen the application processes this input and reflects it back into the web page—for instance, within a hyperlink or a redirection mechanism—the browser interprets the malicious input as executable script code.\nThe attack flow proceeds as follows: 1) The attacker constructs a malicious link incorporating a JavaScript payload in the 'url' parameter. 2) The attacker lures an authenticated or unauthenticated user to click the crafted link or directly navigates them to the vulnerable endpoint with the injected parameter. 3) The server-side code, failing to sanitize the input, embeds the payload into the HTTP response. 4) The victim's browser executes the script upon rendering the page.\nThis is a reflected XSS attack, which is remotely exploitable and does not require prior authentication to the FastAdmin dashboard. The impact is significant as it facilitates the theft of session cookies (if 'HttpOnly' flags are absent), session redirection to malicious sites, or the alteration of the Document Object Model (DOM) to display phishing content.\nThe vulnerability is fixed in version 1.2.1.20210731_beta, associated with the patch identifier 'b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b'.\nPost-exploitation impact includes full compromise of the user's session within the application. If the victim is an administrator, the attacker may leverage the XSS to perform unauthorized administrative actions, such as creating new users or modifying system configurations, depending on the available web-based administrative interfaces."
}