Ka9Q Ubersdr
Monthly
Stored cross-site scripting (XSS) in the chat feature of madpsy's ka9q_ubersdr web SDR interface allows an attacker who can post a chat message to execute arbitrary JavaScript in the browsers of every other user who later views that channel in ka9q_ubersdr before 0.1.58. The linkifier that turns chat URLs into anchors does not neutralize quotation characters, so a crafted URL escapes the generated href attribute and injects attacker-controlled HTML attributes; because the payload is persisted server-side and executes on rendering, no click by the victim is required (the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, matching the published 5.4 severity). Impact is limited to client-side script execution in viewers' browsers rather than server compromise, and no public exploit code has been identified at time of analysis, although the public fix commit (6aa858da1c030cae11b94c7d6c72322adb9ec60d, PR #114) does document the exact vulnerable pattern.
Stored cross-site scripting (XSS) in the chat feature of madpsy's ka9q_ubersdr web SDR interface allows an attacker who can post a chat message to execute arbitrary JavaScript in the browsers of every other user who later views that channel in ka9q_ubersdr before 0.1.58. The linkifier that turns chat URLs into anchors does not neutralize quotation characters, so a crafted URL escapes the generated href attribute and injects attacker-controlled HTML attributes; because the payload is persisted server-side and executes on rendering, no click by the victim is required (the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, matching the published 5.4 severity). Impact is limited to client-side script execution in viewers' browsers rather than server compromise, and no public exploit code has been identified at time of analysis, although the public fix commit (6aa858da1c030cae11b94c7d6c72322adb9ec60d, PR #114) does document the exact vulnerable pattern.