Fanli2012 Native-PHP-CMS Cross-Site Scripting Vulnerability in sysconfig_doedit.php

A cross-site scripting (XSS) vulnerability has been identified in Fanli2012 native-php-cms version 1.0. The issue arises in the file /fladmin/sysconfig_doedit.php, where user input is not properly sanitized before being output, allowing for the injection of malicious scripts. This vulnerability can be exploited remotely and requires user interaction.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, send a POST request to /fladmin/sysconfig_doedit.php with the 'info' parameter containing a script tag, such as '<script>alert(1)</script>'. After submitting the request, navigate to /fladmin/sysconfig_list.php and refresh the page to see the injected script executed.