zTree 3.5.19.1 Cross Site Scripting

`Information  
--------------------  
Advisory by Netsparker.  
Name: Multiple XSS Vulnerabilities in zTree v3  
Affected Software : zTree  
Affected Versions: v3.5.19.1 and possibly below  
Vendor Homepage : https://github.com/zTree/zTree_v3  
Vulnerability Type : Cross-site Scripting  
Severity : Important  
Status : Fixed  
CVE-ID : CVE-2015-7348  
Netsparker Advisory Reference : NS-15-019  
  
Description  
--------------------  
By exploiting a Cross-site scripting vulnerability the attacker can hijack  
a logged in user’s session. This means that the malicious hacker can change  
the logged in user’s password and invalidate the session of the victim  
while the hacker maintains access. As seen from the XSS example in this  
article, if a web application is vulnerable to cross-site scripting and the  
administrator’s session is hijacked, the malicious hacker exploiting the  
vulnerability will have full admin privileges on that web application.  
  
Technical Details  
--------------------  
Proof of Concept URLs for XSS in zTree 3.5.19.1:  
  
/zTree_v3-master/demo/en/asyncData/getNodesForBigData.php?id='"--></style></scRipt><scRipt>alert(0x00FA30)</scRipt>  
  
/zTree_v3-master/demo/en/asyncData/getNodes.php  
(POST, id parameter)  
  
For more information on cross-site scripting vulnerabilities read the  
article Cross-site Scripting (XSS).  
  
Advisory Timeline  
--------------------  
04/09/2015 - First Contact  
16/11/2015 - Vendor Fixed  
17/11/2015 - Advisory Released  
  
Solution  
--------------------  
https://github.com/zTree/zTree_v3  
  
Credits & Authors  
--------------------  
These issues have been discovered by Onur Yilmaz while testing Netsparker  
Web Application Security Scanner (https://www.netsparker.com).  
  
About Netsparker  
--------------------  
Netsparker finds and reports security flaws and vulnerabilities such as SQL  
Injection and Cross-site Scripting (XSS) in all websites and web  
applications regardless of the platform and the technology they are built  
on. Netsparker's unique detection and exploitation techniques allow it to  
be dead accurate in reporting vulnerabilities, hence it is the first and  
only False Positive Free web application security scanner.  
  
--   
Onur Yılmaz - National General Manager  
  
Netsparker Web Application Security Scanner <https://www.netsparker.com>  
T: +90 (0)554 873 0482  
`