Xibo Signage Xibo CMS Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Xibo Signage's Xibo CMS version 4.1.2. This issue arises from inadequate validation of user input, allowing attackers to inject malicious scripts. Exploitation requires creating a template in the 'Templates' section, adding a text element in the 'Global Elements' section, and then inserting the malicious payload into the 'Text' field.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, create a template in the 'Templates' section. Then, add a text element in the 'Global Elements' section. Finally, modify the 'Text' field with the malicious payload.

Remediation

Users can upgrade to Xibo CMS version 4.2.2 to address this vulnerability.