| शीर्षक | pbootcmspro PbootCMS <=V3.2.22 Incomplete Denylist to Cross-Site Scripting |
|---|
| विवरण | When creating or editing an article in the admin panel, the `title` field is passed through `escape_string()`, which encodes it into HTML entities using `htmlspecialchars()`, before it is stored in the database. On the frontend, when the content is read, `->decode()` → `decode_string()` decodes the entities back to the original characters, and the result is then output directly in the `default` branch of the template rendering without a second filtering pass through `filter_html()`. Consequently, HTML/event attributes submitted by an attacker, such as `<script>`, are rendered as raw HTML on the article detail page, list page, and homepage, resulting in stored XSS. An attacker only needs the "content creation/modification" permission (a normal editor role is sufficient) to inject persistent scripts that execute arbitrary JavaScript in the browsers of all users visiting the article/list/homepage, enabling theft of cookies, sessions, sensitive backend data, or phishing. This encode→decode→direct output chain is a long-standing design, and the V3.2.x series is presumed to be affected. |
|---|
| स्रोत | ⚠️ https://github.com/pbootcmspro/PbootCMS/issues/69 |
|---|
| उपयोगकर्ता | rockmelodeis (UID 100628) |
|---|
| सबमिशन | 19/08/2026 10:18 AM (28 दिन पहले) |
|---|
| संयम | 16/09/2026 09:57 AM (28 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 405518 [PbootCMS तक 3.2.22 Template Rendering ContentController.php decode_string शीर्षक क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|