CVE-2021-40926: Cross-site scripting in getID3
Summary
CVE-2021-40926: Cross-site scripting in demos/demo.mysqli.php in getID3. Affects james-heinrich/getid3 versions >= 1.0.0, < 1.9.21. Fixed in 1.9.21. How to fix ↓
Also tracked for
- php-getid3 · Debian:11
The same CVE-2021-40926 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The getID3 package is a PHP library that allows developers to extract metadata from various audio and video file formats. It provides functionality to analyze and retrieve information such as file type, duration, bitrate, and more. The package is widely used in PHP applications for media processing and analysis. However, versions 1.X and v2.0.0-beta of getID3 are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability (CVE-2021-40926) in getID3 arises from a lack of proper input sanitization in the demos/demo.mysqli.php file. Remote attackers can exploit this vulnerability by injecting arbitrary web scripts or HTML through the 'showtagfiles' parameter. This can lead to the execution of malicious code in the context of the affected user's browser, potentially compromising their sensitive information or performing unauthorized actions on their behalf. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.1.
How To Fix
Minimum fixed version
1.9.21
This is the first release that contains the fix.
composer require james-heinrich/getid3:1.9.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize the 'showtagfiles' parameter before using it in the affected file. Here is an example of how to sanitize the parameter using PHP's htmlspecialchars function:
$showtagfiles = htmlspecialchars($_GET['showtagfiles'], ENT_QUOTES, 'UTF-8');
Conclusion
The cross-site scripting vulnerability in getID3 (CVE-2021-40926) can be mitigated by updating to version 1.9.21 or later. Developers should also follow secure coding practices by validating and sanitizing user input to prevent similar vulnerabilities. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for james-heinrich/getid3 →
FAQ
The vulnerability allows remote attackers to inject malicious scripts or HTML into the affected application, potentially leading to the execution of arbitrary code in the user's browser. This can result in various consequences, such as stealing sensitive information, performing unauthorized actions, or defacing the application's web pages.
Versions 1.X and v2.0.0-beta of getID3 are affected by this vulnerability.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended fixes promptly to mitigate the risk of exploitation.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
For more information about the fix, including the specific code changes and release notes, refer to the official getID3 repository on GitHub.
References
Related vulnerabilities
Recent vulnerabilities recorded for james-heinrich/getid3.
