Php · Phamm · CVE-2018-20806
Name of the Vulnerable Software and Affected Versions:
Phamm (aka PHP LDAP Virtual Hosting Manager) version 0.6.8
Description:
The issue allows for XSS via the login page, specifically through the "action" parameter in the /public/main.php API endpoint.
Recommendations:
For Phamm (aka PHP LDAP Virtual Hosting Manager) version 0.6.8, consider restricting access to the /public/main.php API endpoint until a patch is available, and avoid using the `action` parameter in this endpoint to minimize the risk of exploitation.