Headline
CVE-2023-44758: GitHub - sromanhu/GDidees-CMS-Stored-XSS---Title: GDidees CMS 3.9.2 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to t
GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title.
GDidees Stored XSS v3.0****Author: (Sergio)
Description: Cross Site Scripting vulnerability in GDidees v.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Page Title.
Attack Vectors: Scripting A vulnerability in the sanitization of the entry in the Page Title allows injecting JavaScript code that will be executed when the user accesses the web page.
POC:
We edit the “Outils d’édition” and see that we can inject arbitrary Javascript code in the "Titre de la page".
XSS Payload:
'"><svg/onload=prompt(‘text’)>
In the following image you can see the embedded code that executes the payload in the main web.
Additional Information:
https://www.gdidees.eu/cms-1-0.html
https://owasp.org/Top10/es/A03_2021-Injection/