XSS using crafted link

Current version of Framaslides is vulnerable to an XSS attack

How to reproduce

  • A malicious user creates a presentation
  • In the editor, (s)he creates a new website and enters javascript:alert(0) as the URL
  • Optional: (S)he shared the presentation as a model
  • The targeted user clones the model and opens in the editor, or (s)he visits the slides in presentation mode
  • The JS payload is executed

This issue no requires user interaction.