CVE-2017-11503

What it actually does

Cross-site scripting in the From and To email address input fields of code_generator.php allows injection and execution of arbitrary script in the context of users viewing the generated page.

Why it matters to the business

Attackers can hijack user sessions, redirect users to malicious sites, or perform unauthorized actions within the application, increasing risk of data exposure or account compromise in environments using the affected component.

How an attack unfolds

An attacker supplies a crafted email address containing malicious JavaScript to the vulnerable fields; when an administrator or user loads code_generator.php the script executes in the victim's browser, potentially stealing cookies or performing actions on behalf of the user. Public exploit code has been available for years but no named advanced persistent threat groups are tied to this specific flaw.

How to fix it

Upgrade prometheus-bind-exporter (Chainguard) to the fixed version 0 and prometheus-bind-exporter (Wolfi) to the fixed version 0; if a direct PHPMailer dependency is present, ensure PHPMailer 5.2.24 or later is used.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the listed fixed versions and verify that the vulnerable code_generator.php no longer renders unsanitized email address input.

Typical attack path

1. Identify a reachable instance exposing code_generator.php
2. Craft a payload in the From or To email address field that contains executable script
3. Trick a privileged user into viewing the generated output or submitting the form
4. Execute script in the victim's browser to exfiltrate tokens or perform actions

How to detect it

Inspect web server access logs for requests to code_generator.php containing suspicious characters such as angle brackets or script tags in query or POST parameters; review browser history or proxy logs for unexpected script execution originating from the application.

• code_generator.php
• <script
• onerror=
• javascript:

What your security team should do

• Apply the listed fixed package versions immediately given the age of the vulnerability and public exploit availability
• Scan source and dependency trees for any remaining PHPMailer versions prior to 5.2.24
• Add web application firewall rules or input sanitization for email address fields as a compensating control
• Review application logs for any historical use of the code_generator.php endpoint