Skip to content

Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title in the Content - News Menu.

Notifications You must be signed in to change notification settings

sromanhu/CVE-2023-43358-CMSmadesimple-Stored-XSS---News

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 

Repository files navigation

CMSmadesimple Stored XSS v2.2.18

Author: (Sergio)

Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title in the Content - News Menu.

Attack Vectors: Scripting A vulnerability in the sanitization of the entry in the Ttile of "Content - News Menu" allows injecting JavaScript code that will be executed when the user accesses the web page.


POC:

When logging into the panel, we will go to the "Content- News" section off General Menu.

XSS Title

We edit that Content - News Menu with the payload that we have created and see that we can inject arbitrary Javascript code in the Title field.

XSS Payload:

'"><svg/onload=prompt('Title')>

In the following image you can see the embedded code that executes the payload in the main web. XSS Title resultado


Additional Information:

http://www.cmsmadesimple.org/

https://owasp.org/Top10/es/A03_2021-Injection/

About

Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title in the Content - News Menu.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published