Headline
CVE-2021-40555: XSS in page description · Issue #56 · flatCore/flatCore-CMS
Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new page creation form.
Describe the bug
An user with page creation/edition can create an XSS payload in description field to trigger XSS when view all page from admin panel
To Reproduce
Steps to reproduce the behavior:
- Click on ‘Create New Page’
- Go to ‘Meta Tags’ tab
- In the ‘description’ section, insert arbitrary XSS payload
- Go to ‘See all page’
- See error
Expected behavior
The XSS payload will be triggered for anyone who view this page description (esspecially admin account).
Screenshots
Desktop (please complete the following information):
- OS: tested on kali linux
- Browser: tested on firefox
- Version: 2.0.7
video PoC
https://youtu.be/XkjPdJvnMQ0
Additional context
This bug can be exploited by anyone has edit/create page privileges