Lucene search
Hainguyen02077DF6B167-3C39-4563-9B8A-33613E25CF27HistoryAug 25, 2023 - 5:00 p.m.
Store XSS in Widgets and pages
2023-08-2517:00:34
hainguyen0207
www.huntr.dev
12
xss vulnerability
stored xss
proof of concept
admin login
widgets
admin interface
payload
position name
title
save action
video poc
bug bounty
0.0004 Low
EPSS
Percentile
14.2%
Description
I noticed that you filtered the comment very carefully.
But there are still some parts you missed
Proof of Concept
1 .Login with admin
2 .Go to “https://demo.instantcms.io/admin/widgets”
3 . Insert payload in Position name and Title
test" onmouseover = "alert(document.cookie)
4 .Click save , and detect store xss
Video Poc
https://drive.google.com/file/d/14rOcvhHlY7vmcCkks1fbl4KMt3XLd4lp/view?usp=sharing
Related
cvelist
cvelist
CVE-2023-4879 Cross-site Scripting (XSS) - Stored in instantsoft/icms2
2023-09-10 17:53:35
prion
prion
Cross site scripting
2023-09-10 18:15:00
osv
osv
CVE-2023-4879
2023-09-10 18:15:08
cve
cve
CVE-2023-4879
2023-09-10 18:15:08
nvd
nvd
CVE-2023-4879
2023-09-10 18:15:08