Zenar Content Management System Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Zenar Content Management System versions through 7.0. This vulnerability allows unauthenticated attackers to inject malicious scripts by manipulating form parameters in POST requests. The current_page parameter, sent to the ajax.php endpoint, can be exploited to inject script tags. The injected scripts are reflected in the response HTML without proper sanitization, enabling the execution of arbitrary JavaScript in the browsers of affected users.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to the zenario/ajax.php endpoint with the current_page parameter containing the injected script, such as a script tag including JavaScript code, like an alert. The response will reflect the injected script, demonstrating the cross-site scripting vulnerability.