CVE-2023-43879: GitHub - sromanhu/RiteCMS-Stored-XSS---GlobalContent: About RiteCMS 3.0 is affected by a Multiple Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted

Rite CMS v3.0 Multiple Stored XSS****Author: (Sergio)

Description: Rite CMS 3.0 is affected by a Cross-Site scripting (XSS) stored vulnerability that allows attackers to execute arbitrary code via a crafted payload in to the Global Content Blocks in the Administration Menu.

Attack Vectors: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

POC:

When logging into the panel, we will go to the “Administration - Global Content Blocks - Home” .

We edit the body configuration where we add the XSS payloads.

XSS Payload:

'"><svg/onload=alert(‘document.domain’)>

And when we save it, we will see that the XSS pop-up appears