CVE-2021-41432: Stored XSS in the Blog Content · Issue #88 · flatpressblog/flatpress

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Comments

FlatPress 1.2.1 - Stored XSS in the Blog Content

A stored Cross Site Scripting (XSS) vulnerability exists in version 1.2.1 of the FlatPress application that allows for arbitrary execution of JavaScript commands.

Steps to reproduce the vulnerability

1. Visit the FlatPress Administration area.

2. Navigate to the Entries -> Write Entry.

3. Enter any Subject.

4. In the content area put the following payload:

   • <script>alert(document.cookie)</script>

5. Click the Save&Continue button.

6. Stored XSS payload is triggered.

• Also we can verify the stored XSS payload by navigating to the home page.

Discovered by Martin Kubecka, September 15 2021

Copy link

Member

** azett commented Oct 19, 2021**

Hi, thanks for reporting this.
As legitimated site admin, it is okay to add custom HTML or JS to your page - the described behaviour is intended.
Does your findings implicate a way to exploit this behaviour without being logged in as site admin?
Thanks and regards,
Arvid

2 participants