Executive brief
simplephp, a PHP-based web framework, contains a security vulnerability that allows an attacker to inject malicious scripts into the administrative interface. If an administrator is tricked into saving a specially crafted payload in the "Analytics Tracker" configuration, the script will execute automatically for any user visiting the website's homepage. This could lead to the theft of sensitive session cookies, unauthorized access to user accounts, or full takeover of the administrator's session.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the 'Analytics Tracker' module of simplephp (at commit 5184cff). The vulnerability is located in the /admin/config-module.php component, specifically within the "Custom Head Tracking Code" input field. An authenticated attacker with administrative access can inject a malicious script payload which is saved to the server without sufficient sanitization or output encoding. This script is subsequently rendered and executed on the website's homepage for all visitors. This can be leveraged to perform session hijacking via cookie theft or to perform actions on behalf of other authenticated users.
Affected products
- creatorsofcode simplephp GitHub commit 5184cff
Timeline
- 2026-02-27: other: Vulnerable commit identified
- 2026-05-27: disclosed: Vulnerability published by NVD and researcher blog