Executive brief
Bootstrap Multiselect is a popular JavaScript library that extends dropdown controls for selecting multiple items. The library included a PHP example file that echoes untrusted POST data without sanitization. If developers copy this example into production without modification, it enables attackers to inject malicious scripts and trick users into performing unintended actions through forged requests.
Technical details
The vulnerability stems from the post.php example file in Bootstrap Multiselect 1.1.2 and earlier versions, which directly echoes arbitrary POST parameters to the response without HTML encoding or validation. This creates a Reflective Cross-Site Scripting (XSS) vulnerability (CWE-79) that can be chained with Cross-Site Request Forgery (CSRF, CWE-352) attacks. An attacker can craft a malicious URL or form that, when clicked by an authenticated user, submits arbitrary POST data containing JavaScript payloads. The vulnerability requires user interaction (clicking a link/form) but no authentication on the vulnerable endpoint. The fix is available in version 2.0.0, which either removes the vulnerable example file or sanitizes the output.
Affected products
- Bootstrap Multiselect bootstrap-multiselect before 2.0.0
Timeline
- 2025-05-13: disclosed
- 2025-05-15: patched: Fix released in version 2.0.0