CVE-2024-31828

BUG_Author:

F1sher

Affected version:

LavaLite CMS v.10.1.0

Vendor:

https://github.com/LavaLite/cms

Software:

https://github.com/LavaLite/cms/releases/tag/v10.1.0

Describe the bug

Everyone can take advantage of a XSS vulnerability in the URL.

To Reproduce
Enter website address

1	https://lavalite.org/docs/master/"><svg onload=alert(1)>

Expected behavior

Filter keywords such as onload and svg

Impact

Commonly include transmitting private data, like cookies or other session information, to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user’s machine under the guise of the vulnerable site.
Screenshots

OS: Windows
Browser: Google