PublicCMS Cross-Site Scripting Vulnerability in Content Search Module

A cross-site scripting (XSS) vulnerability has been identified in PublicCMS version 5.202506.b, specifically within the Content Search module. This issue allows for the injection of malicious scripts that could be executed in the context of the user.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user.

Reproduction

To reproduce this vulnerability, create content with a name that includes malicious JavaScript. Once the content is saved, the injected script will execute when the Content Search module is accessed. This XSS can be leveraged by a low-privilege user to steal credentials from a super admin, such as the CSRF token, by sending a GET request to admin/index.html.