When uploading a new module, the description of the module can contain JavaScript code. After uploading the new module and looking at the Details
page, the JavaScript code would be executed.
https://github.com/friends-of-forkcms/fork-cms-module-banners/archive/master.zip
, unzipped it and adjusted the description
path of the file
src/Backend/Modules/Banners/info.xml
to this
<description>
<![CDATA[
The banners module.
<script>alert(4);</script>
]]>
</description>
After adjusting the info.xml
file, pack all files back to a zip file and upload it as new module.
After upload, visit the Details page of this module.
Executing any JavaScript an attacker could think of. By default, it is used to steal session cookies.