CVE-2017-7204: imdbphp/imdbphp Cross-Site Scripting (XSS)
Summary
CVE-2017-7204: imdbphp Cross-Site Scripting (XSS). Affects imdbphp/imdbphp versions < 5.2.0. Fixed in 5.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
imdbphp is a package available on Packagist that provides a PHP interface for accessing the IMDb movie database. It allows developers to retrieve information about movies, TV shows, actors, and other related data from IMDb. The package is widely used in PHP applications that require IMDb data integration. However, a vulnerability has been discovered in version 5.1.1 of imdbphp that exposes it to Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
The Cross-Site Scripting (XSS) vulnerability in imdbphp 5.1.1 is caused by inadequate filtering of user-supplied data (name) passed to the "imdbphp-master/demo/search.php" URL. This allows an attacker to inject arbitrary HTML and script code into the vulnerable website, which can then be executed in the context of a victim's browser. The impact of this vulnerability can range from unauthorized data disclosure to the execution of malicious actions on behalf of the user.
How To Fix
Minimum fixed version
5.2.0
This is the first release that contains the fix.
composer require imdbphp/imdbphp:5.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can mitigate the risk by implementing proper input validation and output encoding when using imdbphp. This can help prevent the execution of malicious scripts injected through user-supplied data.
Conclusion
The imdbphp package is vulnerable to Cross-Site Scripting (XSS) attacks in version 5.1.1. It is crucial for developers to upgrade to a fixed version (5.2.0 or later) to mitigate the risk of exploitation. Proper input validation and output encoding should also be implemented to prevent XSS vulnerabilities in applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for imdbphp/imdbphp →
FAQ
imdbphp is a PHP package that provides an interface for accessing the IMDb movie database. It allows developers to retrieve information about movies, TV shows, actors, and more.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized data disclosure, session hijacking, and other malicious activities.
The vulnerability in imdbphp allows an attacker to inject arbitrary HTML and script code into the vulnerable website by manipulating the 'name' parameter passed to the 'imdbphp-master/demo/search.php' URL. This code is then executed in the context of a victim's browser, potentially leading to various security risks.
Yes, the vulnerability has been fixed in version 5.2.0 of imdbphp and later. It is recommended to update to the latest version to ensure the security of your application.
To protect your application from XSS attacks, you should implement proper input validation and output encoding. This ensures that user-supplied data is properly sanitized before being displayed or processed.
