Description

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msg_info page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.2",
  "pubDate": "2026-09-21T16:17:08.210Z",
  "pubdate": "2026-09-21T16:17:08.210Z",
  "executiveSummary": "CuteNews version 2.1.2 is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability stemming from the improper sanitization of user-supplied data within the __referer parameter.\nThe vulnerability resides within the application's msg_info page, where the system fails to neutralize malicious inputs containing javascript: URI schemes.\nAn unauthenticated or remote attacker can craft a malicious URL containing a JavaScript payload and entice an authenticated user into clicking it.\nSuccessful exploitation allows for the execution of arbitrary JavaScript code within the context of the victim's session.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of the user, theft of sensitive session cookies, and unauthorized information disclosure.\nBecause the application renders this unsanitized input as a clickable link, the victim's browser interprets the URI schema and executes the embedded script immediately upon interaction.\nThis vulnerability highlights a failure in input validation and output encoding mechanisms, placing authenticated administrative or user sessions at significant risk.",
  "technicalDetails": "The vulnerability is identified as a Reflected Cross-Site Scripting (XSS) flaw located in the CuteNews v.2.1.2 application, specifically affecting the processing of the __referer parameter.\nThe root cause of this security defect is the application's failure to perform adequate input validation or context-aware output encoding on the __referer value before reflecting it back to the user interface on the msg_info page.\nWhen the application displays informational messages, it includes a link derived from the __referer parameter. Because the application does not restrict the allowed URI schemes, it permits the use of the javascript: pseudo-protocol.\nThe exploitation flow begins when an attacker constructs a malicious URL containing a javascript: payload. For example, by setting the __referer parameter to a string like 'javascript:alert(document.cookie)', the attacker creates a link that, when clicked, will execute the script in the context of the user's browser session.\nThe attacker must entice an authenticated user to interact with this malicious link. Once the authenticated user clicks the link on the msg_info page, the browser evaluates the javascript: URI and executes the payload.\nSince the script executes within the context of the victim's authenticated session, the attacker gains the ability to access the Document Object Model (DOM), intercept sensitive session tokens, manipulate page content, or perform unauthorized operations via the victim's current credentials.\nThis vulnerability is particularly severe because the payload is reflected within an administrative or user-facing notification page, increasing the likelihood that a victim will trust the source of the link. The attack requires no complex exploit infrastructure, only the ability to generate a link and deliver it to the target.\nThe scope of impact is limited to the client-side session of the victim. However, given that administrative sessions in content management systems like CuteNews often have extensive privileges, successful XSS exploitation can lead to full site compromise if the attacker manages to capture session cookies or perform administrative actions via the victim's active session."
}