Kuicms Php EE Persistent Cross-Site Scripting Vulnerability

A persistent cross-site scripting vulnerability has been identified in Kuicms Php EE version 2.0. This vulnerability allows unauthenticated attackers to inject malicious scripts by submitting crafted content through the bbs reply endpoint. Attackers can exploit this issue by sending POST requests to the reply endpoint with HTML and JavaScript payloads in the content parameter, which are then executed in the browsers of users viewing the affected content.

Impact

Exploitation of this vulnerability allows for persistent cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, send a POST request to the /web/?c=bbs&a=reply endpoint. Include a crafted content parameter with HTML and JavaScript payloads. The injected scripts will be executed in the browsers of users who view the affected content.