Tianti Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Tianti version 2.3. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the coverImageURL parameter of the article save AJAX endpoint. The injected script is executed on the front end, affecting all users who access the homepage.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the homepage.

Reproduction

To reproduce this vulnerability, publish an article and replace the cover image URL with an XSS payload, such as an image tag (with an invalid image source) using an 'onerror' attribute. After saving the article, the XSS payload will be executed when users access the homepage.

Remediation

It is recommended to HTML-escape user input before displaying it to prevent the execution of injected scripts.