Miggo Logo
Miggo Vulnerability Database
→
CVE-2011-2935

CVE-2011-2935:
Elgg Reflected XSS Vulnerability

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2011-2935
GHSA ID
GHSA-mcfm-j5g6-w26f
EPSS Score
0.53429%
CWE
CWE-79
Published
4/22/2022
Updated
1/12/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
elgg/elggcomposer<= 1.7.101.7.11

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unsanitized use of the 'internalname' parameter in mod/embed/embed.php. The commit diff shows the fix added htmlentities() sanitization to $internalname, which was previously just retrieved via get_input(). This parameter is directly reflected in the response without encoding in vulnerable versions, enabling the XSS payload demonstrated in the PoC. The file path and parameter handling are explicitly shown in both the vulnerability description and commit diff.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### VULN*R**ILITY **S*RIPTION T** `int*rn*ln*m*` p*r*m*t*r is not prop*rly s*nitiz**, w*i** *llows *tt**k*r to *on*u*t *ross Sit* S*riptin* *tt**k. T*is m*y *llow *n *tt**k*r to *r**t* * sp**i*lly *r**t** URL t**t woul* *x**ut* *r*itr*ry s*ript *o**

Reasoning

T** vuln*r**ility st*ms *rom uns*nitiz** us* o* t** 'int*rn*ln*m*' p*r*m*t*r in `mo*/*m***/*m***.p*p`. T** *ommit *i** s*ows t** *ix ***** `*tml*ntiti*s()` s*nitiz*tion to $int*rn*ln*m*, w*i** w*s pr*viously just r*tri*v** vi* `**t_input()`. T*is p*r