Moonshine Stored Cross-Site Scripting Vulnerability in Article Creation Function

A stored cross-site scripting vulnerability has been identified in Moonshine version 3.12.3. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Link parameter while creating or updating an article. The injected script is then executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, navigate to the 'Blog' section and select 'Articles'. When creating a new article, inject a JavaScript payload into the Link 'CutCode' parameter, using 'javascript:' instead of 'https:'. After saving the article, the injected script will execute when the link is clicked.

Remediation

Users are advised to update to Moonshine version 3.12.5 or later, where this vulnerability has been addressed.