XSS Vulnerability in phpLDAPadmin: Critical Security Flaw in Entry Chooser
Summary
CVE-2017-11107: phpLDAPadmin through 1.2.3 has XSS in htdocs/entry_chooser.php via the form, element, rdn, or container parameter. Affects phpldapadmin across 2 version ranges.
< 1.2.2-6.2
< cfbee19721c88033d735dfd802ae68bb6cfdd1fe
Fixed in 1.2.2-6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpLDAPadmin is a web-based LDAP client that allows users to manage LDAP directories easily. It provides a user-friendly interface for performing various LDAP operations, such as adding, modifying, and deleting entries. Despite its robust functionality, phpLDAPadmin is susceptible to cross-site scripting (XSS) vulnerabilities, which can compromise user data and security.
Vulnerability Detail
The vulnerability identified as CVE-2017-11107 affects phpLDAPadmin versions up to 1.2.3. It arises from improper handling of user input in the entry_chooser.php file, specifically through the 'form', 'element', 'rdn', or 'container' parameters. This flaw allows attackers to inject malicious scripts into the web application, which can be executed in the context of the user's browser. The potential ramifications include unauthorized access to sensitive information, session hijacking, and defacement of the web application.
How To Fix
Minimum fixed version
1.2.2-6.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpldapadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation and sanitization for the affected parameters ('form', 'element', 'rdn', 'container') to mitigate the risk of XSS attacks. This can be done by encoding user inputs before rendering them in the web application.
Conclusion
The CVE-2017-11107 vulnerability in phpLDAPadmin poses significant security risks due to its XSS nature. Users are strongly advised to upgrade to the latest version to protect their applications from potential attacks. Implementing input validation can serve as a temporary workaround until the upgrade is completed.
See every vulnerability recorded for phpldapadmin →
FAQ
CVE-2017-11107 is a cross-site scripting (XSS) vulnerability found in phpLDAPadmin that allows attackers to inject malicious scripts via specific parameters.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, session hijacking, and potential defacement of the web application.
Yes, upgrading phpLDAPadmin to version 1.2.2-6.2 or later will patch this vulnerability.
The CVSS score for CVE-2017-11107 is 6.1, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for phpldapadmin.
