Sayski ForestBlog Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Sayski ForestBlog versions prior to 20250321. The issue arises in the search functionality, where the 'keywords' argument can be manipulated to inject malicious scripts. This vulnerability can be exploited remotely, and the details have been publicly disclosed.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, enter a payload containing a script tag, such as '<script>alert(1)</script>', into the search keywords argument. Once the payload is submitted, a pop-up alert will confirm the successful execution of the injected script.