CSZ CMS HTML Injection Vulnerability in Member Messaging System

A HTML injection vulnerability has been identified in CSZ CMS version 1.2.7. This vulnerability allows authenticated users to inject malicious hyperlinks into message titles. Exploitation involves sending crafted POST requests through the member messaging system, which could be used for phishing or social engineering attacks.

Impact

Exploitation of this vulnerability could lead to HTML injection, allowing for the insertion of malicious links that could be used in phishing or social engineering attacks.

Reproduction

To reproduce this vulnerability, an authenticated user can send a POST request to the '/member/insertpm/' endpoint. The request must include a 'title' parameter containing the injected HTML link, along with a 'message' parameter. This can be done using a tool like Burp Suite or Postman.

Remediation

Users are advised to upgrade to CSZ CMS version 1.3.2, which addresses this vulnerability.