Mtons Mblog Cross-Site Scripting Vulnerability in Post Handler Component

A stored cross-site scripting vulnerability has been identified in Mtons Mblog versions through 3.5.0. The issue arises in the Post Handler component, specifically within the '/post/submit' endpoint. User-controlled input in the 'content' and 'title' parameters is not properly sanitized, allowing for the injection of malicious scripts. This vulnerability can be exploited remotely, and the injected scripts are executed in the context of the user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, send a POST request to the '/post/submit' endpoint with a crafted 'content' or 'title' parameter that includes a script injection payload, such as an image tag with an 'onerror' event. The payload will be executed when the injected content is viewed.