CVE_WBCE

[gozan10]

Exploit Title: XSS Stored Vulnerability in WBCE Version: 1.5.4
Date: 03/11/2022
Exploit Author: Gozan
Contact: https://github.com/gozan10
Product: WBCE CMS (https://github.com/WBCE/WBCE_CMS)
Vendor: WBCE CMS
Description: XSS Stored exitst in Section name field allow attacker excute arbitrary web script

First choose Add Page and fill in all information and click Add, after that click Manage Sections

In the section Name field choose Source button and write payload XSS.

inject javascript

Excute javascript code