WhatCD Gazelle Cross-Site Scripting Vulnerability in Change Log Manager

A stored cross-site scripting vulnerability has been identified in WhatCD Gazelle versions prior to commit 63b337026d49b5cf63ce4be20fdabdc880112fa3. The issue arises in the Change Log Manager component, specifically within the file 'sections/tools/managers/change_log.php'. The vulnerability allows attackers to inject arbitrary HTML or JavaScript into the 'Message' field, which is then executed when an administrator or user views the changelog.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the changelog.

Reproduction

To reproduce this vulnerability, log into a vulnerable instance of WhatCD Gazelle and navigate to the change log manager. Inject a script payload into the message field. Once the message is saved, the injected script will execute when the changelog is viewed.