GHSA-w2w5-w2pw-r929: NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Summary A stored cross-site scripting (XSS) vulnerability exists in NukeViet CMS versions 4.x through 4.5.08. A low-privileged authenticated user can store a JavaScript payload in their profile's display name fields. The payload executes in the browser of any visitor — including administrators — who clicks the Reply ("Answer") link on a comment posted by that user. Affected Component The {COMMENT.post_name} template variable is interpolated without JavaScript-context escaping into an inline onclick handler in both comment block positions: - themes/default/modules/comment/comment.tpl line 27 (top-level comments) - themes/default/modules/comment/comment.tpl line 64 (nested/reply comments) onclick="nv_commment_feedback(event, {COMMENT.cid}, '{COMMENT.post_name}')" Root Cause The first_name and last_name profile fields are sanitized with HTML numeric character references (' → ', ( → (, ) → ), / → /) via Request::_get_title() with $specialchars = true. This encoding is correct for plain HTML attribute and element contexts, but insufficient for a JavaScript string literal embedded inside an HTML attribute. Browsers decode HTML entities in attribute values before the JavaScript engine parses the string. As a result, ' is decoded back to ', which terminates the JS string early and allows the remainder of the value to be executed as JavaScript. The combined display name (nv_show_name_user(first_name, last_name)) is what reaches the template, giving an attacker up to ~200 encoded characters across both fields — sufficient for any practical payload. Proof of Concept Set first_name to the following value in profile settings (/index.php?nv=users&op=editinfo), then post any comment: a');alert(document.domain);// The value is stored as a');alert(document.domain);//. When a visitor clicks the Reply link on the comment, the browser renders: nv_commment_feedback(event, 1, 'a');alert(document.domain);// Tester') causing alert(document.domain) to execute in the visitor'