Bludit Authenticated Stored Cross-Site Scripting(XSS)
Description
Persistent XSS (or Stored XSS) attack is one of the three major categories of XSS attacks, the others being Non-Persistent (or Reflected) XSS and DOM-based XSS. In general, XSS attacks are based on the victim’s trust in a legitimate, but vulnerable, website or web application.Bludit CMS does not filter the content correctly at the "new content" module, resulting in the generation of stored XSS.
Affects CMS
Bludit CMS v3.13.1
Author
Proof of Concept
-
Login the CMS.
-
Open Page http://127.0.0.1:8086/admin/new-content
-
Put XSS payload (<script>alert(1)</script>) in the content box and click on save to publish the page
-
Use "burp" to capture and change packages
-
Viewing the successfully published page,We can see the alert.




