Browser Blocker - Reflected cross-site scripting (XSS)

Summary


Name	Browser Blocker 0.5. - Reflected cross-site scripting (XSS)
Code name	skims-0022
Product	Browser Blocker
Affected versions	Version 0.5.
State	Private
Release date	2025-03-14

Vulnerability


Kind	Reflected cross-site scripting (XSS)
Rule	Reflected cross-site scripting (XSS)
Remote	No
CVSSv4 Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:U
CVSSv4 Base Score	4.8 (Medium)
Exploit available	No
CVE ID(s)	CVE-2025-31299

Description

Browser Blocker 0.5. was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/browser_blocker.php.

Vulnerability

Skims by Fluid Attacks discovered a Reflected cross-site scripting (XSS) in Browser Blocker 0.5.. The following is the output of the tool:

Skims output

 351 | function BrowserBlocker_Options_Page() {
 352 | global $wpdb;
 353 | $wpdb->show_errors();
 354 | $siteurl = get_option('siteurl');
 355 | $plugin_url = $siteurl . '/wp-content/plugins/' . basename(dirname(__FILE__));
 356 | $img_url = $plugin_url . '/images/';
 357 |
 358 | BB_STYLE();
 359 |
 360 | if (isset($_POST['bb_update']) === true) {
 361 |
 362 | if(isset($_POST[""clear""])){
 363 | update_option('Browser_Blocker_Enabled', '0');
 364 | update_option('Browser_Blocker_Credit', '1');
 365 | update_option('Browser_Blocker_Title', '');
 366 | update_option('Browser_Blocker_Msg', '');
 367 | update_option('Browser_Blocker_Splash_Img', '');
 368 | update_option('Browser_Blocker_Blocked', '');
 369 | update_option('Browser_Blocker_Display_Browsers', '1~2~3~5~');
 370 | update_option('Browser_Blocker_Bypass', '0');
 371 | update_option('Browser_Blocker_BPtext', '');
 372 | update_option('Browser_Blocker_Code', '');
 373 |
 374 | $successmessage = ""Browser Blocker Options Cleared Out Successfully"";
 375 | }else{
 376 | $errors=0;
 377 |
 378 | if($_POST['bb_update'] == ""advanced""){
 379 |
 380 | if(get_option('Browser_Blocker_Splash_Img') != $_POST['bb_splash_img']){
 381 | if($_POST['bb_splash_img'] != """"){
 382 | if(!update_option('Browser_Blocker_Splash_Img', $_POST['bb_splash_img'])){
 383 | $errors++;
 384 | }
 385 | }else{
 386 | update_option('Browser_Blocker_Splash_Img', $_POST['bb_splash_img']);
 387 | }
 388 | }
 389 |
 390 | if(get_option('Browser_Blocker_Title') != $_POST['bb_text']){
 391 | if($_POST['bb_text'] != """"){
 392 | if(!update_option('Browser_Blocker_Title', $_POST['bb_text'])){
 393 | $errors++;
 394 | }
 395 | }else{
 396 | update_option('Browser_Blocker_Title', $_POST['bb_text']);
 397 | }
 398 | }
 399 |
 400 | if(get_option('Browser_Blocker_Msg') != $_POST['bb_msg']){
 401 | if($_POST['bb_msg'] != """"){
 402 | if(!update_option('Browser_Blocker_Msg', $_POST['bb_msg'])){
 403 | $errors++;
 404 | }
 405 | }else{
 406 | update_option('Browser_Blocker_Msg', $_POST['bb_msg']);
 407 | }
 408 | }
 409 |
 410 | if(get_option('Browser_Blocker_Code') != $_POST['bb_code']){
 411 | if($_POST['bb_code'] != """"){
 412 | if(!update_option('Browser_Blocker_Code', $_POST['bb_code'])){
 413 | $errors++;
 414 | }
 415 | }else{
 416 | update_option('Browser_Blocker_Code', $_POST['bb_code']);
 417 | }
 418 | }
 419 |
 420 | $downloads = get_option('Browser_Blocker_Display_Browsers');
 421 | $browsers = """";
 422 | for($x=1; $x <= 5; $x++){
 423 | $browserd = ""browser_"".$x;
 424 | if(isset($_POST[$browserd])){
 425 | $browsers .= $x.""~"";
 426 | }
 427 | }
 428 | update_option('Browser_Blocker_Display_Browsers', $browsers);
 429 |
 430 | if(isset($_POST['bb_desctext'])){
 431 | $desctext = 1;
 432 | }else{
 433 | $desctext = 0;
 434 | }
 435 |
 436 | if(get_option('Browser_Blocker_DwnldDesc') != $desctext){
 437 | if(!update_option('Browser_Blocker_DwnldDesc', $desctext)){
 438 | $errors++;
 439 | }
 440 | }
 441 |
 442 | if(isset($_POST['bb_bypass'])){
 443 | $bypass = 1;
 444 | }else{
 445 | $bypass = 0;
 446 | }
 447 |
 448 | if(get_option('Browser_Blocker_Bypass') != $bypass){
 449 | if(!update_option('Browser_Blocker_Bypass', $bypass)){
 450 | $errors++;
 451 | }
 452 | }
 453 |
 454 | if(get_option('Browser_Blocker_BPtext') != $_POST['bb_bypass_text']){
 455 | if($_POST['bb_bypass_text'] != """"){
 456 | if(!update_option('Browser_Blocker_BPtext', $_POST['bb_bypass_text'])){
 457 | $errors++;
 458 | }
 459 | }else{
 460 | update_option('Browser_Blocker_BPtext', $_POST['bb_bypass_text']);
 461 | }
 462 | }
 463 |
 464 | if(isset($_POST['bb_pages'])){
 465 | if($_POST['bb_pages'] != get_option('Browser_Blocker_Pages')){
 466 | if(!update_option('Browser_Blocker_Pages', $_POST['bb_pages'])){
 467 | $errors++;
 468 | }
 469 | }
 470 | }
 471 | }
 472 |
 473 | if(get_option('Browser_Blocker_Enabled') != $_POST['bb_enable']){
 474 | if(!update_option('Browser_Blocker_Enabled', $_POST['bb_enable'])){
 475 | $errors++;
 476 | }
 477 | }
 478 |
 479 | if(isset($_POST['bb_attribute'])){
 480 | $attribute = 1;
 481 | }else{
 482 | $attribute = 0;
 483 | }
 484 |
 485 | if(get_option('Browser_Blocker_Credit') != $attribute){
 486 | if(!update_option('Browser_Blocker_Credit', $attribute)){
 487 | $errors++;
 488 | }
 489 | }
 490 |
 491 | $blocked = """";
 492 | for($x=0; $x < $_POST[""bb_versions_detail""]; $x++){
 493 | if($x > 0){ $blocked .= ""~""; }
 494 | $browser = ""bb_browser_"".$x;
 495 | $direction = ""bb_direction_"".$x;
 496 | $version = ""bb_version_"".$x;
 497 | if(isset($_POST[$browser])){
 498 | $blocked .= ""browser_"".$x."":"".$_POST[$browser].""~direction_"".$x."":"".$_POST[$direction].""~version_"".$x."":"".$_POST[$ver
 499 | }
 500 |
 501 | }
 502 | //echo $blocked;
 503 |
 504 | if(get_option('Browser_Blocker_Blocked') != $blocked){
 505 | if(!update_option('Browser_Blocker_Blocked', $blocked)){
 506 | $errors++;
 507 | }
 508 | }
 509 |
 510 | if($errors == 0){
 511 | $successmessage = ""Browser Blocker Options Updated Successfully"";
 512 | }else{
 513 | $errormessage = ""An Error Occurred While Updating Browser Blocker Options"";
 514 | }
 515 | }
 516 |
 517 | }
 518 |
 519 | //$bb_options = BrowserBlocker_GetOptions();
 520 | ?>
 521 |
 522 | <script type=""text/javascript"">
 523 |
 524 | jQuery(document).ready(function($) {
 525 | $("".fade"").delay(4000).slideUp(1000);
 526 |
 527 | //add rows for new detail options
 528 | $(""#bb_add_browser"").click(function(){
 529 |
 530 | $(""#bb_versions"").removeClass(""hidden"").addClass(""visible"");
 531 | var rows = $(""#bb_versions_detail"").val();
 532 | var browser = $(""#bb_blocked"").val();
 533 | var direction = $(""#bb_direction"").val();
 534 | var version = $(""#bb_blocked_ver"").val();
 535 | var rowid = ""#row"" + rows;
 536 | var new_row = ""<tr id='row"" + rows + ""'><td class='first'><input type='hidden' name='bb_browser_"" + rows + ""' id='bb
 537 | $(""#bb_versions"").append(new_row);
 538 | if(rows2 != 0){
 539 | $(rowid).addClass(""odd"");
 540 |
 541 | }
 542 | $(""#bb_versions_detail"").val(++rows);
 543 |
 544 | });
 545 |
 546 | //remove rows
 547 | $("".removeRow"").live('click', function(){
 548 | var rowid = $(this).closest(""tr"").attr(""id"");
 549 | //alert(rowid);
 550 | var agree = confirm('Are you sure you want to remove this detail row?
This action cannot be undone!');
 551 | if(agree){
 552 | $(""#"" + rowid).remove();
 553 | $(""#bb_versions_detail"").val($(""#bb_versions_detail"").val()-1);
 554 | }else{
 555 | return false;
 556 | }
 557 | });
 558 |
 559 | });
 560 | </script>
 561 |
 562 | <div class=""wrap"">
 563 | <div id=""icon-bb""></div><h2>Browser Blocker Admin Options</h2>
 564 | <?php
 565 | if(isset($successmessage)){
 566 | echo '<div id=""message"" class=""updated fade"">
 567 | <p>
 568 | <strong>
 569 | ' . $successmessage . '
 570 | </strong>
 571 | </p>
 572 | </div>';
 573 | }
 574 |
 575 | if(isset($errormessage)){
 576 | echo '<div id=""message"" class=""error"">
 577 | <p>
 578 | <strong>
 579 | ' . $errormessage . '
 580 | </strong>
 581 | </p>
 582 | </div>';
 583 | }
 584 | ?>
 585 |
 586 | <input type=""hidden"" name=""action"" value=""edit"" />
 587 | <div id=""poststuff"" class=""ui-sortable"">
 588 | <div id=""bb_ids_box"" class=""postbox if-js-open"">
 589 | <h3>Browser Blocker Admin Options</h3>
 590 |
> 591 | <a href=""?page=<?php echo $_GET[""page""] ?>&whichP=simple""><div id=""bb_simple"" class=""tab <?php if(!isset($_GET[""whichP
 592 | <div id=""bb_tabbed"">
 593 |
 594 | <?
 595 | if(isset($_GET[""whichP""]) && $_GET[""whichP""] == ""advanced""){
 596 | require_once('advanced.php');
 597 | }else{
 598 | require_once('simple.php');
 599 | }
 600 | ?>
 601 |
 602 | </div>
 603 |
 604 | </div>
 605 | </div>
 606 |
 607 | </div>
 608 | </div>
  609 | <?php
  610 | }
      ^ Col 0

Our security policy

We have reserved the ID CVE-2025-31299 to refer to this issue from now on.

https://fluidattacks.com/advisories/policy/

System Information

Product: Browser Blocker
Version: 0.5.

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Andres Roldan from Fluid Attacks' Offensive Team using Skims

Timeline

2025-03-14

Vulnerability discovered.

2025-03-14

Vendor contacted.