Blackcat CMS Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Blackcat CMS version 1.4. This vulnerability allows authenticated users to inject malicious scripts into page content. The injected JavaScript payloads are executed when other users view the compromised page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.

Reproduction

To reproduce this vulnerability, log into an account with access to the page modification interface. Navigate to the pages section and select a page to modify. Inject a script payload, such as an image tag with an 'onerror' event, into the page content. Save the changes and then preview the page. The injected script will execute, demonstrating the cross-site scripting vulnerability.