Maybecms Cross-Site Scripting Vulnerability in Article Management Component

A cross-site scripting (XSS) vulnerability has been identified in Maybecms version 1.2, specifically within the Add Article component of the administration panel. The issue arises in the article editing interface, where the 'data_info[content]' parameter can be manipulated to inject malicious scripts. This vulnerability is remotely exploitable and requires user interaction to be triggered.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected content.

Reproduction

To reproduce this vulnerability, log into the Maybecms administration backend and navigate to the 'Add Article' section. In the article body field, inject a script payload and save the article. Then, click the 'View' button to trigger the XSS payload, which will execute in the browser.