Headline
CVE-2019-20803: Cross Site Scripting (XSS) - · Issue #56 · GilaCMS/gila
Gila CMS before 1.11.6 has reflected XSS via the admin/content/postcategory id parameter, which is mishandled for g_preview_theme.
Describe the bug
XSS when a admin click on the link bellow, the g_preview_theme parameter not encoding the double quotes, an attacker could trick the admin to click on that link…
https://demo.gilacms.com/cm/edit_form/postcategory?id=8%22+%3E%3Cscript%3Ealert(1)%3C/script%3E
To Reproduce
Steps to reproduce the behavior:
- Go to ‘https://demo.gilacms.com/admin/content/postcategory’
- Click on ‘edit’
- With a web proxy like burp intercept that request, and after id= parameter put " "+><script>alert(1)</script>
- See the alert on browser…
Screenshots
If applicable, add screenshots to help explain your problem.
Desktop (please complete the following information):
- Browser Firefox
- Version 70.0 (64-bit)
Additional context
In fact the attacker could trick any admin to click on
https://demo.gilacms.com/cm/edit_form/postcategory?id=8%22+%3E%3Cscript%3Ealert(1)%3C/script%3E … and execute javascript…