MaxSite CMS Cross-Site Scripting Vulnerability in Down_Count Plugin

A cross-site scripting (XSS) vulnerability has been identified in MaxSite CMS versions prior to 109.3, specifically within the down_count plugin. The issue arises from improper sanitization of the f_file and f_prefix parameters, allowing attackers to inject malicious scripts. This vulnerability can be exploited remotely and has been publicly disclosed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user, potentially leading to account compromise or unauthorized actions within the administrative panel.

Reproduction

To reproduce this vulnerability, upload a script containing a malicious payload to a location accessible by the web server. Then, use the down_count plugin's settings to reference this file or prefix, which will inject the script into the page. The injected script will execute when the page is viewed, demonstrating the cross-site scripting vulnerability.

Remediation

Users are advised to upgrade to MaxSite CMS version 109.4, which addresses this vulnerability by implementing proper input sanitization. The update can be downloaded from the MaxSite CMS GitHub repository.