Subrion CMS Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the installation module of Subrion CMS version 4.2.1. This vulnerability allows attackers to execute arbitrary JavaScript in the context of the user's browser by injecting a crafted payload into the database username, password, and name parameters.

Impact

Exploitation of this vulnerability allows for arbitrary JavaScript execution in the context of the user's browser, specifically on the installation page. This could lead to the exfiltration of cookies, session tokens, or unauthorized actions being performed on behalf of the user.

Reproduction

To reproduce this vulnerability, access the installation configuration page of Subrion CMS 4.2.1. In the database-related fields (dbuser, dbpwd, dbname), enter a payload that includes a SVG element with an 'onload' event. Submit the form, and if the vulnerability exists, an alert will be triggered, indicating that the JavaScript has been executed.