MobileDetect 2.8.31 Cross Site Scripting

MobileDetect 2.8.31 contained a Cross-Site Scripting (XSS) vulnerability (CVE-2023-50953).

The library, MobileDetect 2.8.31 contained a Cross-Site Scripting (XSS) vulnerability (CVE-2023-50953).

The library, designed to detect device types from the User-Agent string, would return unescaped values from this string. Methods like `getVersion()` or `getScriptVersion()` were particularly affected.

If an application using MobileDetect directly rendered these unescaped outputs into an HTML context without further sanitization, an attacker could inject malicious JavaScript. By crafting a malicious User-Agent header containing script tags, an attacker could execute arbitrary client-side code in a victim's browser.

This reflected XSS issue was addressed in versions 2.8.32 and 2.8.33, where the library added `htmlspecialchars()` to sanitize outputs. However, applications should always escape user-supplied data before rendering it to prevent XSS.

# Exploit Title: MobileDetect 2.8.31 - Cross-Site Scripting (XSS)
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/serbanghita/Mobile-Detect/
# Software Link: https://github.com/serbanghita/Mobile-Detect/
# Version: 4da80e5
# Tested on: Windows
# CVE : CVE-2018-25080

Proof Of Concept:
GET http://mobiledetect/examples/session_example.php/%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E

Steps to Reproduce
1. Login as an admin user.
2. Send the request.
3. Observe the result: