Feehi CMS Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Feehi CMS version 2.1.1. This vulnerability allows authenticated users to inject arbitrary web scripts or HTML into the Title parameter of the article creation and editing module. The injected payload is then executed when the article is viewed, potentially leading to cookie theft from the victim's browser.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the article.

Reproduction

To reproduce this vulnerability, an authenticated user can create a new article and inject an XSS payload into the title field. After saving the article, the injected payload will be executed when the article is viewed.

Remediation

It is recommended to implement input sanitization and filtering for the title field to prevent the injection of malicious scripts.