mtons mblog Reflected Cross-Site Scripting Vulnerability in Admin Panel

A reflected cross-site scripting vulnerability has been identified in mtons mblog versions through 3.5.0. The issue arises in the admin panel, specifically within the /admin/post/list file. The vulnerability is triggered by manipulating the user-controlled 'title' parameter, which lacks proper security checks and output encoding. This flaw allows remote attackers to execute scripts in the context of the user's browser session.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the victim's browser.

Reproduction

To reproduce this vulnerability, access the /admin/post/list endpoint in the admin panel. Use the search function and manipulate the 'title' parameter by entering a value that includes a script injection, such as an image tag with an 'onerror' event. The injected script will be executed, demonstrating the cross-site scripting vulnerability.