Sitefinity CMS 9.2 Cross Site Scripting

`# Exploit Title: Stored Cross Site Scripting (XSS) in Progress Sitefinity CMS 9.2  
# Date: Aug 31, 2017  
# Exploit Author: Pralhad Chaskar  
# Vendor Homepage: http://www.sitefinity.com/  
# Tested on: Progress Sitefinity CMS 9.2 and lower  
# CVE : NA  
  
Vendor Description  
------------------  
ProgressA(r) SitefinityaC/ is a content management and marketing analytics platform designed to maximize the agility needed to succeed in todayas rapidly changing digital marketplace. It provides developers and IT teams the tools they need to support enterprise-level digital marketing, optimizing the customer journey by delivering seamless personalized experiences across different technologies and devices. Progress is a trusted source for the digital marketing innovation needed to create transformative customer experiences that fuel business success.  
  
Description  
------------  
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.  
  
Vulnerability Class  
--------------------  
Cross-site Scripting (XSS) - https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)  
  
Proof of Concept  
----------------  
Below mentioned input fields aren't properly escaped. This could lead to an XSS attack that could possibly affect administrators, users, editor.  
  
http://xx.sitefinity.com/Sitefinity/Pages  
Parameter : Page Title  
Method: POST  
  
http://xx.sitefinity.com/Sitefinity/Content/News  
Parameter : News Title  
Method: POST  
  
http://xx.sitefinity.com/Sitefinity/Content/List  
Parameter : List Title  
Method: POST  
  
http://xx.sitefinity.com/Sitefinity/Content/Documents/LibraryDocuments/incident-request-attachments  
Parameter : Document Title  
Method: POST  
  
http://xx.sitefinity.com/Sitefinity/Content/Images/LibraryImages/newsimages  
Parameter : Image Title  
Method: POST  
  
http://xx.sitefinity.com/Sitefinity/Content/links  
Parameter : Link Title  
Method: POST  
  
http://xx.sitefinity.com/Sitefinity/Content/Videos/LibraryVideos/default-video-library  
Parameter : Video Title  
Method: POST  
  
Vendor Contact Timeline  
------------------------  
Discovered: October 16, 2016  
Vendor Notification: October 18, 2016  
Advisory Publication: Aug 31, 2017  
Public Disclosure: Aug 31, 2017  
  
Affected Targets  
----------------  
Sitefinity CMS 9.2 and lower  
  
Solution  
--------  
Upgrade to Sitefinity CMS 10.1 to fix this issue.  
  
Credits  
-------  
Pralhad Chaskar  
Information Security Analyst  
Help AG Middle East  
  
References  
----------  
[1] Help AG Middle East http://www.helpag.com/  
[2] Sitefinity CMS Version Notes http://www.sitefinity.com/product/version-notes  
  
`