Description

Cross-Site Scripting (XSS) is a type of security vulnerability that occurs when an attacker injects malicious code, usually in the form of scripts, into a web application. This code is then executed by unsuspecting users who visit the affected web page. in this case the path of ./install/index.php?space=XSS is vulnerable to this attack, the line 59 takes input without any validation.

I should mention that local file enumeration is also possible using the error: <FILE> does not exist and if the file do exist we dont any error.

Proof of Concept

install/index.php?1692443074&space=../index.phv"><img%20src=1%20onerror=alert(1)>

screen shot of xss: https://wormhole.app/YXAjY#4tugWnQRULX2djrg_d-nAQ

Impact

An attacker could execute javascript into victim browser