CVE-2020-36397: 
PHP vulnerability analysis and mitigation

A stored cross site scripting (XSS) vulnerability exists in the /admin/contact/contact component of LavaLite 5.8.0, identified as CVE-2020-36397. The vulnerability was discovered and disclosed on July 2, 2021. This security flaw allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter (CVE Details).

The vulnerability is a stored XSS type that affects the Contact feature in LavaLite CMS version 5.8.0. The attack vector is network-based, requires low privileges, and user interaction is necessary for exploitation. The vulnerability stems from insufficient input validation in the "New" parameter of the contact component, allowing malicious scripts to be stored and executed (AttackerKB).

When successfully exploited, this vulnerability could allow attackers to transmit private data like cookies or session information, redirect victims to attacker-controlled web content, or perform other malicious operations under the guise of the vulnerable site. The attack requires authentication and user interaction to be successful (GitHub Issue).

The vulnerability requires an authenticated user account and can be exploited by submitting specially crafted payloads through the Contact feature's "New" parameter. A proof of concept exists demonstrating that the removal of script tags is not sufficient to prevent the XSS attack (GitHub Issue).

The primary mitigation strategy involves HTML Entity encoding any output that is reflected back to the page, as the simple removal of script tags has proven insufficient to prevent XSS attacks (GitHub Issue).