Description

CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form edit endpoint, which lacks proper authorization controls. Attackers can persist malicious script payloads into the database that execute in victims' browsers when the contact form loads, enabling cookie theft, forged authenticated requests against the admin interface, and session takeover of viewing users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-12T20:17:55.480Z",
  "pubdate": "2026-08-12T20:17:55.480Z",
  "executiveSummary": "CamaleonCMS contains a stored cross-site scripting (XSS) vulnerability located within the cama_contact_form plugin. The vulnerability arises from inadequate input sanitization and a lack of proper authorization controls on the contact form edit endpoint. Low-privileged authenticated attackers can exploit this flaw by submitting arbitrary HTML and malicious script payloads into the before_html field. Once submitted, the malicious payloads are persistently stored within the database.\nThe impact of this vulnerability is significant, as the stored scripts execute automatically within the browsers of victims when the affected contact form loads. This capability enables severe security consequences, including session cookie theft, the forgery of authenticated requests targeting the administrative interface, and full session takeover of viewing users, particularly those with higher privileges. Exploitation requires authenticated access with low privileges and the ability to interact with the vulnerable contact form management functionality.",
  "technicalDetails": "The vulnerability is a stored cross-site scripting (XSS) flaw affecting the cama_contact_form plugin in CamaleonCMS. The root cause of the issue stems from two primary security deficiencies: the contact form edit endpoint lacks proper authorization controls, allowing unauthorized or low-privileged authenticated users to access and modify form parameters, and the application fails to properly sanitize or encode user-supplied input submitted to the before_html field.\nAttackers initiate the exploitation process by authenticating with low privileges and navigating to the contact form edit endpoint. Because the endpoint does not enforce adequate access controls, the attacker is permitted to modify the configuration of the contact form. During this modification, the attacker injects arbitrary HTML containing malicious script payloads into the before_html field.\nThe vulnerable component processes the unsanitized input and persists the malicious payload directly into the database without performing context-aware output encoding or strict input validation. Consequently, whenever an administrative user or any other victim views the contact form interface where the before_html field is rendered, the database retrieves the stored payload and injects it directly into the victim's browser DOM.\nThe payload executes within the security context of the victim's active session. Post-exploitation activities enabled by this behavior include the theft of session cookies, the execution of unauthorized administrative actions via forged requests originating from the victim's browser, and complete session hijacking and takeover of high-privilege users interacting with the management interface."
}