{"id":"CVE-2024-56517","aliases":["GHSA-ggwq-xc72-33r3"],"url":"https://o3.security/vulnerability/CVE-2024-56517","summary":"LGSL has a reflected XSS at /lgsl_files/lgsl_list.php","details":"# Reflected XSS at /lgsl_files/lgsl_list.php\n\n\n**Description:**\n\nVulnerability: A reflected XSS vulnerability exists in the `Referer` HTTP header of [LGSL v6.2.1](https://github.com/tltneon/lgsl/releases/tag/v6.2.1). The vulnerability allows attackers to inject arbitrary JavaScript code, which is reflected in the HTML response without proper sanitization.\nWhen crafted malicious input is provided in the `Referer` header, it is echoed back into an HTML attribute in the application’s response.\n\n\nThe vulnerability is present at [Line 20-24](https://github.com/tltneon/lgsl/blob/master/lgsl_files/lgsl_list.php#L20-L24)\n```php\n  $uri = $_SERVER['REQUEST_URI'];\n\n  if ($lgsl_config['preloader']) {\n    $uri = $_SERVER['HTTP_REFERER'];\n  }\n```\n\n**Proof of Concept:**\n1. Capture a request to the path `/lgsl_files/lgsl_list.php`.\n2. Inject the following payload into the Referer header: `test'><script>alert(1)</script><`.\n3. Send the request.\n4. The XSS payload is triggered when reloading.\n![image](https://github.com/user-attachments/assets/467a6c60-db45-4520-9918-59dff819b384)\n![image](https://github.com/user-attachments/assets/c537c59e-38c2-47f0-97d8-54ee1b2018b8)\n\n\n\n**Impact:**\n\nExecution of Malicious Code\n\n","published":"2024-12-30T16:36:08.785Z","modified":"2026-08-12T03:51:14.837165077Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"tltneon/lgsl","fixedVersion":null}],"fix":{"url":"https://github.com/tltneon/lgsl/commit/7ecb839df9358d21f64cdbff5b2536af25a77de1","label":"tltneon/lgsl@7ecb839"},"references":[{"type":"WEB","url":"https://github.com/tltneon/lgsl/blob/master/lgsl_files/lgsl_list.php#L20-L24"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56517.json"},{"type":"ADVISORY","url":"https://github.com/tltneon/lgsl/security/advisories/GHSA-ggwq-xc72-33r3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56517"},{"type":"FIX","url":"https://github.com/tltneon/lgsl/commit/7ecb839df9358d21f64cdbff5b2536af25a77de1"},{"type":"PACKAGE","url":"https://github.com/tltneon/lgsl"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:14.837165077Z"}}