Summary
CTparental before 4.45.03 is vulnerable to cross-site scripting (XSS).
Product
CTparental before 4.45.03
Impact
Attacker could potentially trick the admin into clicking a crafted link that sends the admin authentication cookie to a server under the attacker’s control and the attacker would be able to gain access to the admin panel.
Steps to reproduce
To reproduce exploiting the vulnerability, enter the following link in the browser:
https://admin.ct.local/bl_categories_help.php?cat=<script>alert('xss');</script>
Expected result:
The browser pops an alert.
Remediation
Update CTparental to 4.45.03 or above
https://gitlab.com/marsat/CTparental/-/releases/4.45.03
Credit
This issue was discovered and reported by Checkmarx Security Researcher
Or Sahar.
