Cdevroe Unmark Cross-Site Scripting Vulnerability in Marks Info View

A cross-site scripting (XSS) vulnerability has been identified in Cdevroe Unmark versions through 1.9.3. The issue resides in the application/views/marks/info.php file, where an unfiltered title argument is outputted, allowing for the injection of malicious scripts. This vulnerability can be exploited remotely and has been made public.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the bookmark details.

Reproduction

To reproduce this vulnerability, upload an SVG file containing a script element with JavaScript code, such as an alert, into a vulnerable Unmark instance. Then, add this SVG file as a bookmark. When the bookmark is accessed, the JavaScript will execute, demonstrating the cross-site scripting vulnerability.