GHSA-5822-pw57-vv37: 
PHP vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in Pterodactyl Panel, affecting versions before 0.7.19 and versions between 1.0.0-rc.0 and 1.0.0-rc.6. The vulnerability was disclosed on October 3, 2020, and was assigned the identifier GHSA-5822-pw57-vv37. The issue was identified by security researcher Sergej and was classified as a moderate to high severity security flaw (GitHub Advisory).

The vulnerability stems from improper sanitization of account names in the admin area of the Pterodactyl Panel. Specifically, the issue manifests when rendering account names to the dropdown selector during server creation or modification processes. The vulnerability is classified as CWE-79, which is typical for XSS-type vulnerabilities (GitHub Advisory).

The XSS vulnerability could potentially allow attackers to execute malicious scripts through unsanitized account names in the admin area of the Pterodactyl Panel. This could lead to unauthorized actions being performed in the context of the admin user's session (GitHub Advisory).

The vulnerability exists in the admin area when creating or modifying servers, specifically in the user dropdown selector. While specific exploit details were not publicly disclosed, the vulnerability requires access to account creation or modification capabilities (GitHub Advisory).

The vulnerability has been patched in versions 0.7.19 and 1.0.0-rc.7 of the Pterodactyl Panel. For users unable to update immediately, no direct workaround exists without manual patching. The fix can be reviewed in the patch files available at the pull request #2441 (GitHub Advisory).