An unauthenticated stored XSS vulnerability in MajorDoMo allows remote attackers to hijack administrator sessions by injecting malicious payloads into the shoutbox widget.

The application fails to sanitize input within the shoutbox widget, where the /objects/?method= endpoint allows an unauthenticated user to inject raw data into the database. This data is subsequently rendered without escaping in the dashboard, triggering execution when an administrator views the auto-refreshing widget.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript within the browser of a logged-in administrator. This can lead to complete session hijacking, unauthorized configuration changes, or the exfiltration of sensitive administrative cookies, resulting in a total compromise of the MajorDoMo installation. With a CVSS score of 7.2, this vulnerability represents a high risk to the confidentiality and integrity of the management environment.

Immediate Action: Update to the latest version of MajorDoMo as provided in the vendor repository to incorporate necessary input sanitization and output escaping.

Proactive Monitoring: Review web server access logs for anomalous requests to the /objects/ endpoint, particularly those involving the shoutbox or method parameters containing script tags.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS patterns and restrict access to the /objects/ endpoint from untrusted networks.

Public Exploit Available: Yes, a technical write-up detailing the attack mechanism exists via the references provided in the CVE record.

Given the ease of exploitability and the potential for full administrative account takeover, this vulnerability poses a severe risk to any deployment of MajorDoMo. Administrators must prioritize updating the software immediately and should treat any existing instance as potentially compromised if exposed to the public internet.