Description
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attributes that are emitted unescaped, executing script in viewers' browsers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
PHPOffice PHPPresentation
Default version status: unaffected
1.2.0 to ≤ 1.2.0affected
pkg:composer/phpoffice/phppresentationReferences
- https://hackmd.io/@leediay/multiple_vulnerable_phppresentation ↗
- https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/Writer/HTML.php#L307-L330 ↗
- https://github.com/PHPOffice/PHPPresentation ↗
- https://www.vulncheck.com/advisories/phppresentation-1.2.0-xss-via-writer-html-text-runs-hyperlinks-and-descriptions ↗