Qianfox FoxCMS Cross-Site Scripting Vulnerability in Product Management Controller

A cross-site scripting (XSS) vulnerability has been identified in Qianfox FoxCMS versions up to 1.2.16. The issue resides in the Product management controller, specifically within the add and edit functions of the app/admin/controller/Product.php file. The vulnerability is triggered by manipulating the Title parameter, which is not properly sanitized before being output. This flaw allows remote attackers to inject malicious scripts that are executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page. This could lead to session hijacking, theft of sensitive information such as cookies, simulation of malicious actions, or alteration of page content.

Reproduction

To reproduce this vulnerability, send a POST request to the Product edit or add endpoint with a crafted Title parameter that includes JavaScript code, such as an input element with an onmouseover event. The application will process this input without proper sanitization, allowing the script to execute when the content is viewed.