--- title: "CX-2016-4451" date: "2016-05-18T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2016-4451/" --- # CX-2016-4451 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Aug 18, 2016 CVE-2016-10510 **Published:** May 18, 2016 6.1 Medium Severity kohana php XSS DS David Sopas Reported by Checkmarx Zero Details Overview ## Summary A Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the strip\_image\_tags protection mechanism in system/classes/Kohana/Security.php. ## Product Kohana before 3.3.6 ## Impact If exploited, a threat actor will be able to execute arbitrary Javascript in the browser of a victim who accesses the vulnerable application. ## Steps to reproduce The vulnerable function uses faulty regex to check to filter potentially malicious HTML and JavaScript inputs from <img> tags, as can be seen in the below snippet: ``` public static function strip_image_tags($str) { return preg_replace('#s]*)["']?[^>]*)?>#is', '$1', $str); } ``` In order to exploit this issue, a threat actor may pass the following payload to the vulnerable function: ``` ``` As the regex is expecting a space character after the img tag, this payload will be accepted. ### Expected result The JavaScript will execute in the victim’s browser. ## Remediation Update Kohana dependency to 3.3.6 and above ## Credit This issue was discovered and reported by Checkmarx Security Researcher [@dsopas (David Sopas)](https://twitter.com/dsopas). ## Resources 1. [Issue](https://github.com/kohana/kohana/issues/107) 2. [Release notes](https://github.com/kohana/kohana/releases/tag/v3.3.6) 3. [Advisory](https://lists.debian.org/debian-lts-announce/2018/01/msg00015.html) 0 Medium Severity CVSS v3.1 Score 6.1 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None Advisory Timeline1. Discovered May 18, 2016 Reported to mantainer 2. Fixed Aug 18, 2016 Fixed version in v3.3.6 ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)