Mezzanine CMS Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability exists in Mezzanine CMS version 6.1.0, specifically within the blog post creation feature. This vulnerability allows authenticated attackers to inject and execute arbitrary web scripts or HTML by embedding a crafted payload into a blog post. The issue arises because the application does not properly sanitize user input, enabling the execution of malicious scripts in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the blog post. This could lead to various attacks, such as defacing the website or causing a denial-of-service by disrupting normal site operations.

Reproduction

To reproduce this vulnerability, an authenticated user can create a new blog post in Mezzanine CMS 6.1.0. After injecting a script payload into the post and publishing it, the script will execute when the post is viewed. This can be done by accessing the blog post with a browser that supports JavaScript, such as Firefox.