Stored XSS in the Blog Content

[martinkubecka]

FlatPress 1.2.1 - Stored XSS in the Blog Content

A stored Cross Site Scripting (XSS) vulnerability exists in version 1.2.1 of the FlatPress application that allows for arbitrary execution of JavaScript commands.

Steps to reproduce the vulnerability

1. Visit the FlatPress Administration area.
2. Navigate to the Entries -> Write Entry.
3. Enter any Subject.
4. In the content area put the following payload:
   • <script>alert(document.cookie)</script>

5. Click the Save&Continue button.
6. Stored XSS payload is triggered.

• Also we can verify the stored XSS payload by navigating to the home page.

Discovered by Martin Kubecka, September 15 2021

[azett]

Hi, thanks for reporting this.
As legitimated site admin, it is okay to add custom HTML or JS to your page - the described behaviour is intended.
Does your findings implicate a way to exploit this behaviour without being logged in as site admin?
Thanks and regards,
Arvid

[azett]

Adding JS to your entries is by design. Nothing to fix here until further notice.