Update nbm.php

[hugbubby]

No description provided.

[zeropath-ai-dev]

✅ No security or compliance issues detected. Reviewed everything up to f21a4c2.

Security Overview

• 🔎 Scanned files: 1 changed file(s)
• 🔗 Scan Link: https://dev.branch.zeropath.com/app/repositories/d9cf8881-7d91-495e-919b-1821f32afbca?scanId=d94e9e81-711f-4f2a-b9b1-1d4f04ae5ee2&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Other	► nbm.php     Added echo $_GET['asdf'];

Reply to this PR with @zeropath-ai followed by a description of what change you want and we'll auto-submit a change to this PR to implement it.

[zeropath-ai-staging]

Reflected XSS Vulnerability in nbm.php (Severity: MEDIUM)

This reflected cross-site scripting (XSS) vulnerability in nbm.php allows an attacker to inject arbitrary JavaScript into the application, potentially leading to session hijacking or defacement. The vulnerability exists because the application directly reflects the asdf parameter from the GET request in the response on line 24 without proper sanitization or escaping, which causes the browser to execute any injected scripts.
_{View details in ZeroPath}

Suggested change

	echo $_GET['asdf'];
	echo isset($_GET['asdf']) ? htmlspecialchars($_GET['asdf'], ENT_QUOTES|ENT_SUBSTITUTE, 'UTF-8') : '';

[zeropath-ai-staging]

❌ Possible security or compliance issues detected. Reviewed everything up to f21a4c2.

The following issues were found:

• Cross Site Scripting (XSS)

  • Location: nbm.php:24
  • Score: MEDIUM (68.0)
  • Description: Reflective XSS: User-controlled input is echoed directly to the response without sanitization or escaping.
  • Link to UI: https://staging.branch.zeropath.com/app/issues/2dc978ff-f5a6-40e5-be16-3ccc1f1a7e99

Security Overview

• 🔎 Scanned files: 1 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/c5d8a022-9631-45a3-937f-404f77ff821a?scanId=0ef67c89-45f3-4666-9c6f-e2c017359ed0&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Other	► nbm.php     Added echo $_GET['asdf'];