Description
Zenar Content Management System contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating form parameters in POST requests. Attackers can inject script tags through the current_page parameter sent to the ajax.php endpoint, which reflects unsanitized user input in the response HTML to execute arbitrary JavaScript in victim browsers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zenar | Zenar Content Management System | 7.0 | — |
References
- ExploitDB-44664 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: Zenar Content Management System Cross-Site Scripting via ajax.php third-party-advisory