PHPJabbers Simple CMS Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in PHPJabbers Simple CMS version 5.0. This vulnerability allows authenticated attackers to inject malicious scripts into the section name parameters. When administrators view these sections, the embedded JavaScript payloads execute, potentially leading to client-side code execution.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected section.

Reproduction

To reproduce this vulnerability, log into the PHPJabbers Simple CMS 5.0 application. Navigate to the section creation feature and enter a script payload, such as an image tag with an error event, into the section name field. Once the section is saved, the injected script will execute an alert message, indicating successful exploitation.