Headline
CVE-2022-27441: XSS storage vulnerability exists in tpcms v3.2 management system · Issue #I3YUCJ · 快乐源泉/tpcms - Gitee.com
A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Phone text box.
Logging into the management system of tpcms v3.2 (admin/admin888), in the “System Settings”-“Site Configuration”-“Bottom Information”(or “Phone”), entering XSS payload and save it. Open the front-site and you can see the pop-up window caused by the XSS payload.
URL:
http://IP/index.php/Admin/Index/index.html
Payload:
<script>alert('hello ');</script>
This vulnerability can be used in conjunction with the XSS platform. The attacker enters the malicious payload in the corresponding text box. Whenever the visitor visits the TPCMS, the visitor’s information can be sent to the XSS platform.It can be used to Phising or something else.
