Executive brief
CuteNews is a content management and news publishing system. The application fails to sanitize the HTTP Referer header, allowing an attacker to inject malicious scripts that execute in a victim's browser when they visit a crafted link. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.
Technical details
A reflected cross-site scripting vulnerability exists in index.php where the Referer header value is copied directly into the HTML response without escaping or sanitization. An attacker crafts a malicious Referer header containing JavaScript payloads and tricks a user into making a POST request to index.php (via a crafted link or form). The injected script then executes in the victim's browser with access to session cookies and page context.
Affected products
- CuteNews CuteNews 2.1.2
Timeline
- 2026-09-21: disclosed