Pachno Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Pachno version 1.0.6. This issue allows attackers to execute arbitrary HTML and script code by injecting malicious payloads into POST parameters. The vulnerability arises from improper sanitization of input via Request::getRawParameter() and Request::getParameter() calls, enabling injected scripts to be executed in the context of the user's browser session.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, inject a script or HTML payload into one of the following POST parameters: value, comment_body, article_content, description, or message. This can be done through multiple controllers. The injected payload will be stored in the database and executed in the user's browser session.