Pluck CMS Stored Cross-Site Scripting Vulnerability in Albums Module

A stored cross-site scripting vulnerability has been identified in Pluck CMS versions through 4.7.21. The issue resides in the Albums Module, specifically within the 'data/modules/albums/albums.admin.php' file. The vulnerability arises because user input in the image description field is not properly sanitized before being displayed on the frontend, allowing for the injection of malicious JavaScript. This vulnerability can be exploited remotely, and the injected script is executed in the context of the user viewing the affected album.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the context of the user viewing the album, potentially leading to the theft of non-HttpOnly cookies and the execution of same-origin requests to privileged backend endpoints.

Reproduction

To reproduce this vulnerability, an authenticated administrator must log into the Pluck CMS admin panel and navigate to the Albums Module. After creating or editing an album, the administrator can inject a script payload into the image description field. Once the album is saved, the injected script will execute when the album is viewed on the frontend.

Remediation

Remove 'htmlspecialchars_decode()' from untrusted frontend output paths and apply appropriate output encoding before rendering user-controlled content. Treat album description data as untrusted input and consider sanitizing dangerous HTML in backend input handling.