FluentCMS Cross-Site Scripting Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in FluentCMS version 1.2.3. The issue arises in the admin interface, specifically within the 'Add Page' feature, where user input is not adequately sanitized before being displayed. This flaw enables remote attackers to inject arbitrary script tags, which are then executed in the context of the victim's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute malicious scripts in the context of the user's session.

Reproduction

To reproduce this vulnerability, log in as an admin and navigate to the 'Add Page' function. Once there, input a script tag, which will be reflected and executed, demonstrating the cross-site scripting vulnerability.

Remediation

Users are advised to implement proper input validation and output encoding on both the frontend and backend.