Stored XSS in Raytha CMS Profile Editing Allows Code Injection

Executive Summary

The vulnerability in Raytha CMS is a Stored Cross-Site Scripting (XSS) issue that occurs via the FirstName and LastName parameters in the profile editing functionality.

An authenticated attacker can inject arbitrary HTML and JavaScript code into the website through these parameters.

This malicious code is then stored and executed whenever someone visits the edited profile page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute malicious scripts in the context of the affected website.

Potential impacts include theft of user session cookies, defacement of the website, redirection to malicious sites, or performing actions on behalf of other users.

Since the attacker must be authenticated, the risk is limited to users with access, but it still poses a significant security threat.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Raytha CMS to version 1.4.6 or later, where the issue has been fixed.

Useful 0 Not Useful 0