RageFrame2 2.6.43 has a reflective XSS vulnerability

[Hebing123]

Summary

RageFrame2 2.6.43 has a reflective cross-site scripting (XSS) vulnerability. An attacker can execute malicious code in the admin's browser by inducing the admin to click on a link containing malicious code.

Details

RageFrame2 2.6.43 does not sufficiently filter the boxid parameter, allowing an attacker to insert arbitrary html code by prematurely ending the script tag with the </script> closing.

Proof of Concept (POC)

http://your-ip/backend/file/selector?boxId=1</script><script>alert(%27test%27)</script>&multiple=0&upload_drive=local&upload_type=images