Roothub Cross-Site Scripting Vulnerability in System Configuration Admin Controller

A cross-site scripting (XSS) vulnerability has been identified in Roothub versions through 2.6. The issue resides in the 'Edit' function of the 'SystemConfigAdminController.java' file, where user input is not properly sanitized before being output, allowing for the injection of malicious scripts. This vulnerability can be exploited remotely and requires user interaction.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, upload an image with an 'onerror' attribute pointing to a JavaScript alert. After saving, the injected script will execute, demonstrating the cross-site scripting flaw.