Feehi CMS Stored Cross-Site Scripting Vulnerability in Role Management Module

A stored cross-site scripting vulnerability has been identified in the Role Management module of Feehi CMS version 2.1.1. This vulnerability allows authenticated attackers to inject arbitrary web scripts or HTML into the Role Name parameter, which is then executed when an admin views the log. The injected script could potentially steal cookies from other admin users.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected role.

Reproduction

To reproduce this vulnerability, an admin user can create a new role and enter a script payload into the Role Name field. Once saved, the role will display the injected script, which will execute and could be used to steal cookies from other admin users.

Remediation

Users are advised to sanitize and filter input in the Role Name parameter to prevent the injection of malicious scripts.