GetmeUK ContentTools Cross-Site Scripting Vulnerability in Image Handler Component

A cross-site scripting (XSS) vulnerability has been identified in GetmeUK ContentTools versions through 1.6.16. The issue arises in the Image Handler component, where the 'onload' attribute can be manipulated to inject malicious JavaScript. This vulnerability can be exploited remotely and requires user interaction.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, upload an image with an 'onload' attribute containing a JavaScript payload to a WYSIWYG editor using GetmeUK ContentTools. Save the changes, and the injected script will execute, demonstrating the cross-site scripting vulnerability.