Description: Multiple cross-site scripting (XSS) vulnerabilites in install/adduser.php of CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again in the My Preferences - Add user.
Attack Vectors: Scripting a vulnerability in the sanitization of the entry in the password and password of "My Preferences - Add user." allows injecting JavaScript code that will be executed when forward the request.
When logging into the panel, we will go to the "My Preferences - Add user" section off General Menu.
We edit that Content - News Menu with the payload that we have created and see that we can inject arbitrary Javascript code in the assword and password again field.
'"><svg/onload=alert('password')>'"><svg/onload=alert('password again')>In the following image you can see the embedded code that executes the payload when forward the request.
