Moonshine Stored Cross-Site Scripting Vulnerability in Admin Creation Function

A stored cross-site scripting vulnerability has been identified in Moonshine version 3.12.3, specifically within the Create Admin function. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name parameter.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, navigate to the 'Admins' section under the 'System' tab and select 'Create'. In the 'Name' input field, insert a payload such as an image tag with an 'onerror' event, such as 'javascript:alert("XSS")'. After saving, the injected script will execute when the 'Blog -> Articles' section is accessed.