REDAXO CMS Stored Cross-Site Scripting Vulnerability Allowing Arbitrary Code Execution

A stored cross-site scripting vulnerability has been identified in REDAXO CMS version 5.17.1. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the password parameter of the /media/test.html component. Additionally, this vulnerability can lead to authenticated arbitrary code execution, according to the vulnerability's author.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, with the potential for arbitrary code execution on the server where REDAXO CMS is hosted.