📄 Blesta 5.13.1 Cross Site Scripting

---------------------------------------------------------------------------
    Blesta <= 5.13.1 (confirm_url) Reflected Cross-Site Scripting Vulnerability
    ---------------------------------------------------------------------------
    
    
    [-] Software Link:
    
    https://www.blesta.com
    
    
    [-] Affected Versions:
    
    All versions from 3.2.0 to 5.13.1.
    
    
    [-] Vulnerability Description:
    
    User input passed through the "confirm_url" GET parameter to the
    /dialog/confirm and /client_dialog/confirm/ endpoints is not properly
    sanitized before being used to generate HTML output; specifically,
    before being used as action attribute of an HTML form. This can be
    exploited by attackers to perform 2-clicks Reflected Cross-Site
    Scripting (XSS) attacks.
    
    
    [-] Proof of Concept:
    
    An attacker may trick a victim Blesta user into clicking on links like these:
    
    http://[blesta]/dialog/confirm/?confirm_url=javascript:alert('XSS')
    http://[blesta]/client_dialog/confirm/?confirm_url=javascript:eval(atob('YWxlcnQoJ1hTUyBvbiAnK2RvY3VtZW50LmRvbWFpbik='))
    
    When the victim user clicks on the malicious link and then they also
    click on the "Yes" button, the form will be submitted, and the
    attacker-controlled JavaScript code will be executed on the victim
    user's browser.
    
    
    [-] Solution:
    
    Apply the vendor patch or upgrade to version 5.13.2 or later.
    
    
    [-] Disclosure Timeline:
    
    [19/01/2026] - Vendor notified
    
    [22/01/2026] - CVE identifier requested
    
    [28/01/2026] - Version 5.13.2 released
    
    [31/01/2026] - Version 5.13.3 released to address regressions
    introduced in 5.13.2
    
    [03/02/2026] - CVE identifier assigned
    
    [04/02/2026] - Public disclosure
    
    
    [-] CVE Reference:
    
    The Common Vulnerabilities and Exposures project (cve.org) has
    assigned the name CVE-2026-25616 to this vulnerability.
    
    
    [-] Credits:
    
    Vulnerability discovered by Egidio Romano.
    
    
    [-] Other References:
    
    https://www.blesta.com/2026/01/28/security-advisory/
    
    
    [-] Original Advisory:
    
    https://karmainsecurity.com/KIS-2026-01