Alkacon OpenCMS Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Alkacon OpenCMS version 17.0. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the author parameter while creating or modifying an article.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected article.

Reproduction

To reproduce this vulnerability, create a new article in OpenCMS 17.0. In the author field, inject a script payload, such as a script tag containing JavaScript code, such as an alert. Save and publish the article. When a user clicks the 'Read More' button on the article, the injected script will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users are advised to upgrade to the latest release of OpenCMS.