Victor CMS Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Victor CMS version 1.0. The issue resides in the 'comment_author' POST parameter, allowing attackers to inject malicious JavaScript that is executed in the context of the victim's browser. This vulnerability can be exploited by submitting crafted comments through the comment submission form.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of users who view the affected comments.

Reproduction

To reproduce this vulnerability, send a POST request to 'post.php' with the 'comment_author' parameter containing a script tag, such as '<script>alert(1)</script>'. Include a valid session cookie to simulate an authenticated user. Once the comment is submitted, the injected script will execute when the comment is viewed.