Remote code execution via stored report script

Stored XSS in the Report function of Unisite CMS 5.0 allows remote attackers to execute code after an administrator views a report. The public form stores attacker-supplied JavaScript and the admin panel renders it without neutralization, allowing the script to steal the administrator’s session cookie. Administrator interaction is required; the stolen session grants access to the template editor, where PHP can be written into a template and invoked as a web shell.