Stored XSS in Live Helper Chat v4.60 Facebook registration page

Successful exploitation allows persistent client-side script execution in the security context of the vulnerable Live Helper Chat application for users who load the affected page or stored content. Depending on victim privileges, this can enable session hijacking, theft of anti-CSRF tokens or other sensitive page data, unauthorized actions performed as the victim, content defacement, phishing overlays, and administrative compromise if an administrator views the malicious content.

As interim mitigation, restrict access to the affected Facebook registration functionality where feasible, monitor for and remove malicious stored payloads from application data, and deploy a strong Content Security Policy to reduce script execution impact, recognizing CSP is not a complete fix. Mark session cookies HttpOnly and SameSite where possible, minimize administrative exposure to untrusted content, and use web application firewall rules to detect common XSS payload patterns targeting the Name parameter.

Upgrade to a vendor-fixed version if one is available. In the affected code path, apply strict contextual output encoding/escaping before rendering the Name parameter into HTML, attribute, JavaScript, or DOM contexts as appropriate. Enforce server-side input validation to reject or sanitize active content where such input is not required, and review the Facebook registration page and related templates/controllers for unsafe storage and rendering of user-supplied fields. Regression-test for persistent and reflected XSS across registration and profile-display workflows.