Executive brief
NewsLister is a web application used for managing and displaying news articles. A security flaw allows an authenticated user with administrative access to embed malicious scripts into news titles. These scripts will automatically run in the browsers of other users who view the news items, potentially leading to unauthorized actions or data theft.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in NewsLister versions 1.0 and earlier. The flaw is located in the news addition interface within the admin panel, specifically in the 'title' parameter. An authenticated attacker with low-level administrative privileges can submit a crafted JavaScript payload that is stored in the application's database. This script is subsequently executed in the context of any user (including other administrators) who views the affected news item. The vulnerability stems from improper neutralization of input during web page generation (CWE-79). A public exploit is available on Exploit-DB.
Affected products
- NetArt Media NewsLister <= 1.0
Timeline
- 2020-11-27: other: Vulnerability discovered
- 2020-12-02: disclosed: Exploit published on Exploit-DB
- 2026-05-16: advisory: NVD/VulnCheck advisory published