Dcat-Admin Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Dcat-Admin version 2.2.1-beta. This issue arises from an unknown processing of the file '/admin/auth/roles' within the Roles Page component. The vulnerability allows for the injection of malicious scripts, which can be executed in the context of the user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, log into the application with the default credentials (admin/admin). Navigate to the Roles Page under the admin section. Create a new role and inject a script payload into the slug module, while filling in the name field. Once submitted, the injected script will execute, demonstrating the cross-site scripting vulnerability.