Yii2-StateMachine extension for Yii2 cross-site scripting vulnerability (CNVD-2018-11842)

Yii2-StateMachine extension for Yii2 is a demo website system for demonstrating the Yii2 framework. A cross-site scripting vulnerability exists in the Yii2-StateMachine extension for Yii2 version 2.x.x. The vulnerability stems from the program failing to strictly filter the 'role' parameter. A...