NewsLister Authenticated Persistent Cross-Site Scripting Vulnerability

A persistent cross-site scripting vulnerability has been identified in NewsLister versions through 1.0. This vulnerability allows authenticated administrators to inject malicious scripts via the title parameter in the news addition interface. The injected JavaScript payloads execute when the news items are viewed by other users.

Impact

Exploitation of this vulnerability allows for authenticated persistent cross-site scripting, where injected scripts are executed in the context of the user viewing the news item.

Reproduction

To reproduce this vulnerability, log into the admin panel of NewsLister. Navigate to the news addition interface and enter a JavaScript payload into the title field. Once the news item is saved, the injected script will execute when the news is viewed by other users.