Otale Tale Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Otale Tale versions through 2.0.5. The issue arises in the OptionsService function within the default header template. The vulnerability allows remote attackers to inject malicious JavaScript by manipulating the logo_url argument. This flaw exists in products that are no longer supported by the maintainer.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, navigate to the 'theme/setting' route and input a logo URL that includes executable HTML or JavaScript, such as an image tag with an 'onerror' event. The application will not properly sanitize this input, leading to the execution of the injected script.