XSS using crafted markdown link
Current version of Framaslides is vulnerable to an XSS attack
How to reproduce
- A malicious user creates a presentation
- In a the markdown editor, (s)he enters:
- The targeted user visits the slides in presentation mode and clicks on the malicious link
- The JS payload is executed
This issue doesn't seems to affect the editor part.