HooskCMS Cross-Site Scripting Vulnerability Allowing Denial-of-Service

A cross-site scripting (XSS) vulnerability has been identified in HooskCMS version 1.8. This vulnerability allows remote attackers to cause a denial-of-service by exploiting the custom Link title and Title parameters. The issue occurs on the editing navigation page when creating or modifying navigation items.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, navigate to the editing or creation page for navigation items. Inject a script payload, such as a JavaScript alert, into the custom Link title or Title parameter. Once the payload is submitted, the injected script will be executed, demonstrating the cross-site scripting vulnerability.