MaxSite CMS Cross-Site Scripting Vulnerability in ushki Plugin

A cross-site scripting (XSS) vulnerability has been identified in MaxSite CMS versions prior to 109.4, specifically within the ushki plugin. The issue arises from an unknown function that fails to properly sanitize user input in the f_ushka_new and f_ushk arguments, allowing attackers to inject malicious scripts. This vulnerability is stored, meaning it does not require repeated interaction to exploit and can affect multiple users. The exploitation is remote and has been made public.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users are advised to upgrade to MaxSite CMS version 109.4 or later. The latest version can be downloaded from the MaxSite CMS GitHub repository.