A cross site scripting vulnerability in Open Source Social Network 8.6 allows authenticated administrators to execute malicious scripts, posing a significant risk of session hijacking and account compromise.

This vulnerability is a Cross Site Scripting (XSS) flaw occurring within the administrator interface. It requires an authenticated user with administrative privileges to trigger the injection through the param parameter.

Successful exploitation of this vulnerability allows an attacker to inject arbitrary scripts into the administrator dashboard. Given the elevated privileges of the target interface, this could result in full account takeover, unauthorized modification of platform settings, or the theft of sensitive administrative session tokens. The CVSS score of 7.3 reflects the high impact on confidentiality and integrity, necessitating prompt remediation to prevent unauthorized system control.

Immediate Action: Update to the latest version of Open Source Social Network, as the vendor has addressed this flaw in subsequent releases following version 8.6.

Proactive Monitoring: Monitor server access logs for unusual activity involving the u/administrator/friends endpoint and investigate any suspicious parameters containing script tags.

Compensating Controls: Implement or tune a Web Application Firewall (WAF) to detect and block common XSS patterns directed at the administrative interface.

Public Exploit Available: No (exploit_available: false)

The identified XSS vulnerability poses a serious risk to the integrity of the administrative environment. Organizations running OSSN version 8.6 should prioritize updating their software to the latest version provided by the vendor. Failure to apply this update leaves administrative accounts vulnerable to potential exploitation and session compromise.