PbootCMS Cross-Site Scripting Vulnerability in admin.php

A cross-site scripting (XSS) vulnerability has been identified in PbootCMS version 3.2.9. The issue occurs in admin.php when the 'p' parameter is set to '/Content/index/mcode/2#tab=t2'.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into the PbootCMS admin panel and navigate to the content management section. Select a news item to edit, and enter a payload, such as an image tag with an 'onerror' event, into the content title field. Save the changes, then return to view the item, which will trigger the injected script.