EyouCMS Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in EyouCMS version 1.6.7. The issue resides in the login.php file, specifically within the admin system web interface for the Chinese language. This vulnerability is classified as a stored XSS, as the injected script is executed after being saved to the database.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, log into the EyouCMS admin panel and navigate to the system web settings. Inject a script, such as an image tag with a JavaScript URL, into the website title. After saving, the injected script will be executed when the title is rendered.