Stored XSS in CamaleonCMS via Draft Title Parameter

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in CamaleonCMS versions 2.9.1 and earlier. It allows authenticated low-privileged users to inject unsanitized HTML payloads into the post title parameter when creating drafts. The malicious payload is stored in the database without proper escaping and later rendered as raw HTML in the admin drafts listing, enabling attackers to execute arbitrary JavaScript in an administrator's browser.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for POST requests to the drafts creation endpoint containing unsanitized HTML payloads in the post title parameter. Check server logs for suspicious draft titles with script tags or event handlers. Use browser developer tools to monitor admin drafts listing for rendered raw HTML.

Useful 0 Not Useful 0

Impact Analysis

Successful exploitation could lead to administrator session compromise, cookie theft, and forged authenticated requests. Attackers could gain control over an administrator's session, steal sensitive data, or perform actions on behalf of the administrator.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update CamaleonCMS to version 2.9.2 or later. Implement input validation to sanitize all user-provided data, especially post titles. Apply output encoding when rendering draft titles in admin interfaces. Restrict low-privileged user permissions to minimize attack surface.

Useful 0 Not Useful 0