Cross-site Scripting (XSS) - Generic in hestiacp/hestiacp


Reported on

Feb 17th 2022


The user-controlled GET user parameter in index.php is unsanitized resulting in Cross-Site Scripting.

Proof of Concept


GET https://{HOST}/edit/user

**File: /web/edit/user/index.php#L11

// Check user argument
if (empty($_GET['user'])) {
    header("Location: /list/user/");



This vulnerability is capable of running malicious Javascript code on web pages, stealing a user's cookie and gaining unauthorized access to that user's account through the stolen cookie.

We are processing your report and will contact the hestiacp team within 24 hours. 2 years ago
We have contacted a member of the hestiacp team and are waiting to hear back 2 years ago
We have sent a follow up to the hestiacp team. We will try again in 7 days. 2 years ago
Jaap Marcus
2 years ago


Example provided doesn't work how ever


does work fine. So the issue it self is valid

Jaap Marcus validated this vulnerability 2 years ago
Faisal Fs ⚔️ has been awarded the disclosure bounty
The fix bounty is now up for grabs
Jaap Marcus
2 years ago


@admin Please provide a CVE for this vulnerability

Jamie Slome
2 years ago


Sorted! 🎊


We have sent a fix follow up to the hestiacp team. We will try again in 7 days. 2 years ago
Jaap Marcus marked this as fixed in 1.5.9 with commit ee10e2 2 years ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation