YouDianCMS Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in YouDianCMS version 9.5.21. The issue arises in the file '/App/Tpl/Admin/Default/Channel/index.html', where the application improperly processes the 'Parent' parameter. This lack of security filtering allows attackers to inject malicious JavaScript, which is then executed in the context of the user's browser. The vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious scripts in the victim's browser session.

Reproduction

To reproduce this vulnerability, log into the YouDianCMS admin panel and navigate to the channel management section. Once there, add a script payload into the 'Parent' parameter of the URL. The injected script will be executed as an alert, demonstrating the cross-site scripting vulnerability.