Multiple cross-site scripting (XSS) vulnerabilities in Pulse Pro CMS 1.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) d parameter in a blocks action and (2) post_id parameter in an edit-post action to index.php.
Pulse Pro CMS 1.7.2 is vulnerable to multiple cross-site scripting (XSS) attacks, allowing attackers to inject malicious scripts into web pages viewed by other users. This can lead to session hijacking, data theft, and website defacement, severely impacting the confidentiality and integrity of the affected website.
Step 1: Payload Delivery: The attacker crafts a malicious URL containing a JavaScript payload within the vulnerable parameters (d or post_id). For example: index.php?action=blocks&d=<script>alert('XSS')</script> or index.php?action=edit-post&post_id=<script>alert('XSS')</script>.
Step 2: Request Submission: The attacker sends the crafted URL to a victim, typically through phishing, social engineering, or by embedding it in a compromised website.
Step 3: Server Processing: The Pulse Pro CMS server receives the request and processes the parameters. Due to the lack of proper sanitization, the injected script is not filtered.
Step 4: Content Rendering: The server renders the content, including the attacker's injected JavaScript payload, within the HTML response.
Step 5: Browser Execution: The victim's browser receives the malicious HTML and executes the injected JavaScript, leading to the execution of the attacker's code within the context of the vulnerable website. This could involve stealing cookies, redirecting the user, or other malicious actions.
The vulnerability stems from insufficient input validation and output encoding within Pulse Pro CMS 1.7.2. Specifically, the d parameter in the blocks action and the post_id parameter in the edit-post action of index.php are not properly sanitized before being displayed to users. This allows attackers to inject arbitrary HTML and JavaScript code. The root cause is a failure to implement proper input validation to filter out malicious characters and a lack of output encoding to escape potentially dangerous characters when rendering user-supplied data. This results in the browser interpreting the injected code as part of the website's legitimate content, leading to the execution of the attacker's script.