MRCMS Cross-Site Scripting Vulnerability in File Upload Component

A cross-site scripting (XSS) vulnerability has been identified in MRCMS version 3.1.2. The issue resides in the file upload function of the FileController component, specifically within the /admin/file/upload.do interface. The vulnerability arises from improper handling of the 'path' parameter, which allows attackers to inject malicious JavaScript that could be executed in the context of the user’s browser, potentially leading to theft of login credentials.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, access the /admin/file/upload.do endpoint and include a crafted 'path' parameter that contains malicious JavaScript, such as a script tag with JavaScript code, such as an alert() function. This can be done by sending a request to the server with the malicious 'path' value.