Rocket LMS Persistent Cross-Site Scripting Vulnerability

A persistent cross-site scripting vulnerability has been identified in Rocket LMS version 1.1, specifically within the support ticket module. This vulnerability allows authenticated users to inject malicious scripts through the title parameter of support tickets. The injected scripts are executed in the browsers of users who view the message history, potentially leading to session hijacking and phishing attacks.

Impact

Exploitation of this vulnerability allows for persistent cross-site scripting, where injected scripts are executed in the context of the user viewing the message history. This could lead to session hijacking and phishing attacks.

Reproduction

To reproduce this vulnerability, an authenticated user can submit a support ticket through the 'New Ticket' interface. The user should inject a script payload into the title parameter, which will be executed when the message history is viewed.