WuzhiCMS Cross-Site Scripting Vulnerability in Group Management Function

A cross-site scripting (XSS) vulnerability has been identified in WuzhiCMS version 4.1.0. The issue arises in the 'del' function within the 'group.php' file, located in the 'coreframe/app/member/admin' directory. This vulnerability exists because the function fails to properly sanitize callback parameters, allowing for the injection of malicious scripts.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, navigate to the Member Group Management section of the WuzhiCMS admin panel. Use the delete function for a group, and intercept the request to include a crafted callback parameter that triggers a JavaScript alert. This can be done by modifying the request payload to include the XSS payload in the callback parameter, which will then be executed when the response is processed by the browser.

Remediation

Users are advised to update to a version of WuzhiCMS that addresses this vulnerability. If no update is available, implement input validation and sanitization measures to escape potentially harmful characters and prevent XSS attacks.