Headline

CVE-2023-43345: GitHub - sromanhu/CVE-2023-43345-Quick-CMS-Stored-XSS---Pages-Content: Quick CMS 6.7 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a cra

Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Content - Name parameter in the Pages Menu component.

1 year ago

CVE

Open in Source

#xss #vulnerability #web #git #java #auth

Quick CMS Stored XSS v6.7****Author: (Sergio)

Description: A Cross-Site Scripting (XSS) vulnerabilitie in Quick CMS v6.7 allows a local attacker to execute arbitrary code via a crafted script to the to the Content - Name in the Pages Menu.

Attack Vectors: Scripting A vulnerability in the sanitization of the entry in the Nmae of Content of Pages Menu allows injecting JavaScript code that will be executed when the user accesses the web page.

POC:

When logging into the panel, we will go to the “Content - Name” section off Pages.

We edit that Content Settings and see that we can inject arbitrary Javascript code in the Name field.

XSS Payload:

In the following image you can see the embedded code that executes the payload in the main web.

Additional Information:

https://opensolution.org/cms-system-quick-cms.html

https://owasp.org/Top10/es/A03_2021-Injection/