CVE-2024-37160: 
PHP vulnerability analysis and mitigation

Formwork, a flat file-based Content Management System (CMS), was found to contain a cross-site scripting (XSS) vulnerability identified as CVE-2024-37160. The vulnerability was discovered and disclosed on June 7, 2024, affecting all versions of Formwork prior to 1.13.1. This security issue allows attackers with administrator privileges to execute arbitrary web scripts by modifying site options through the /panel/options/site path (GitHub Advisory).

The vulnerability is classified as a stored XSS with a CVSS v3.1 base score of 4.8 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The issue stems from improper neutralization of input during web page generation (CWE-79). The vulnerability specifically affects the site options functionality, where unescaped meta attributes could lead to script execution (GitHub Advisory).

The vulnerability enables persistent cross-site scripting attacks that affect visitors across all pages of the website, except for the dashboard. Once exploited, the injected malicious JavaScript executes on every page a victim visits, including about, blog, contact, or any other pages. This widespread impact makes the vulnerability particularly concerning as a single injection point leads to execution across the entire site (GitHub Advisory).

The vulnerability requires administrator privileges to exploit, making it somewhat limited in scope. The attack can be executed by accessing the /panel/options/site path and injecting malicious JavaScript into the description field. The persistent nature of the attack means it affects all subsequent visitors to the website (GitHub Advisory).

The vulnerability has been patched in Formwork version 1.13.1, which implements proper escaping of all metadata attributes. Users are advised to upgrade to this version or later. The fix has also been implemented in Formwork 2.x through commit f531201 (GitHub Patch).