SofaWiki 3.9.2 Cross Site Scripting

`# Exploit Title: SofaWiki 3.9.2 - Reflected XSS (Authenticated) via Regex  
Replace Preview  
# Date: 10/17/2024  
# Exploit Author: Chokri Hammedi  
# Vendor Homepage: https://www.sofawiki.com  
# Software Link: https://www.sofawiki.com/site/files/snapshot.zip  
# Version: 3.9.2  
# Tested on: Windows XP  
  
*Summary:*  
  
A *reflected XSS* vulnerability exists in the *Regex Replace Preview*  
feature of SofaWiki. When a malicious payload is injected into the *Replace*  
field, the payload is executed immediately in the user’s browser during the  
preview.  
Proof of Concept (PoC):  
  
1. Login to SofaWiki.  
2. Go to Special => Regex :  
http://localhost/sofawiki/index.php?action=view&name=special:regex&lang=en  
  
3. In the Regex field, enter any text (e.g., test).  
4. In the Replace field, inject the following payload:  
  
<script>alert('XSS');</script>  
  
5. Click Replace Preview to trigger the XSS.  
`