ShishuoCMS Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in ShishuoCMS version 1.1. The issue arises in the Directory Deletion Page, specifically within the '/manage/folder/add.json' file. The vulnerability is triggered by manipulating the 'folderName' argument, allowing for the injection of malicious scripts. This issue can be exploited remotely.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, navigate to the 'Directory Deletion' section under 'Administrator Management'. Create a new directory and enter a script payload in the 'folderName' field. Once the directory is created, the script will execute, demonstrating the cross-site scripting vulnerability.