LightCMS 1.3.4 - 'exclusive' Stored XSS

🗓️ 26 Feb 2021 00:00:00Reported by PeithonType

exploitdb🔗 www.exploit-db.com👁 173 Views

LightCMS v1.3.4 'exclusive' stored XSS vulnerabilit

Reporter	Title	Published	Views	Family All 11
0day.today	LightCMS 1.3.4 - (exclusive) Stored XSS Vulnerability	26 Feb 202100:00	–	zdt
Circl	CVE-2021-3355	24 Feb 202118:36	–	circl
CNNVD	LightCMS v跨站脚本漏洞	24 Feb 202100:00	–	cnnvd
CNVD	LightCMS Cross-Site Scripting Vulnerability	26 Feb 202100:00	–	cnvd
CVE	CVE-2021-3355	24 Feb 202115:00	–	cve
Cvelist	CVE-2021-3355	24 Feb 202115:00	–	cvelist
EUVD	EUVD-2021-26686	7 Oct 202500:30	–	euvd
NVD	CVE-2021-3355	24 Feb 202115:15	–	nvd
Packet Storm	LightCMS 1.3.4 Cross Site Scripting	26 Feb 202100:00	–	packetstorm
Prion	Cross site scripting	24 Feb 202115:15	–	prion

# Exploit Title: LightCMS 1.3.4 - 'exclusive' Stored XSS
# Date: 25/02/2021
# Exploit Author: Peithon
# Vendor Homepage: https://github.com/eddy8/LightCMS
# Software Link: https://github.com/eddy8/LightCMS/releases/tag/v1.3.4
# Version: 1.3.4
# Tested on: latest version of Chrome, Firefox on Windows and Linux
# CVE: CVE-2021-3355

An issue was discovered in LightCMS v1.3.4.(https://github.com/eddy8/LightCMS/issues/18) There is a stored-self XSS, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.

--------------------------Proof of Concept-----------------------

1. Log in to the background.

2. Navigate to System -> `/admin/SensitiveWords/create` & add the below-shared payload as the exclusive field value. Payload - </span><img src=1 onerror=alert(1) /><span>

3. Visit page `/admin/SensitiveWords`, the payload will be triggered.

26 Feb 2021 00:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 23.5

CVSS 3.15.4

EPSS0.00215

LightCMS 1.3.4 - &#039;exclusive&#039; Stored XSS

LightCMS 1.3.4 - 'exclusive' Stored XSS