OpenRapid RapidCMS Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in OpenRapid RapidCMS version 1.3.1. The issue resides in the '/user/user-move.php' endpoint, where the 'username' GET parameter is not properly sanitized, allowing remote, unauthenticated attackers to inject malicious scripts. This vulnerability requires user interaction, as an authenticated administrator must visit the crafted URL for the exploit to succeed.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's session. This could lead to session hijacking, unauthorized actions, or information disclosure.