JoeyBling Bootplus Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in JoeyBling Bootplus versions prior to commit 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. The issue arises from the application's failure to properly sanitize input on the admin/sys/admin.html page, allowing attackers to inject malicious JavaScript. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, navigate to the admin/sys/admin.html page. The input email field does not properly filter user input, enabling the insertion of JavaScript code. For example, an image tag with an 'onerror' event could be used to trigger an alert, demonstrating the XSS exploit.