Rymcu Forest Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Rymcu Forest versions through 0.0.5. The issue arises in the XssUtils.replaceHtmlCode function within the XssUtils.java file, specifically related to article content, comments, and portfolio descriptions. This vulnerability allows authenticated users to inject malicious JavaScript that is executed when the content is viewed. The injection can bypass certain filters by using unfiltered HTML tags and events to execute scripts in the context of the user’s browser.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected content.

Reproduction

To reproduce this vulnerability, an authenticated user must log into the application and create an article containing a JavaScript payload. This payload will be executed when the article is viewed, demonstrating the cross-site scripting vulnerability.