CMSimple Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in CMSimple version 5.4. This issue arises from the application's input filtering, which can be bypassed using HTML to Unicode encoding. Attackers can inject malicious scripts by encoding payloads, such as ')-alert(1)//, and execute arbitrary JavaScript when victims interact with delete buttons.

Impact

Exploitation of this vulnerability allows for DOM-based cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, upload a file through the application's image upload feature. Encode the payload ')-alert(1)// using HTML to Unicode encoding, and include it in the uploaded file. When the victim clicks the delete button associated with the uploaded file, the encoded script will be executed as an alert.