Schlix CMS Cross-Site Scripting Vulnerability in Login Logs

A stored cross-site scripting vulnerability has been identified in Schlix CMS versions prior to 2.2.9-5. The issue arises from inadequate JavaScript sanitization in the login form, allowing malicious payloads to be logged as XSS and executed in the admin panel. This vulnerability requires the admin to access the login attempt logs page for exploitation.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected logs. This could lead to session hijacking, credential theft through stolen cookies or localStorage, phishing attacks, or unauthorized actions performed on behalf of the victim.

Remediation

Users are advised to upgrade to Schlix CMS version 2.2.9-5, which addresses this vulnerability.