f697a81a18
12 changes to exploits/shellcodes Sony IPELA Network Camera 1.82.01 - 'ftpclient.cgi' Remote Stack Buffer Overflow BrightSign Digital Signage Diagnostic Web Server 8.2.26 - Server-Side Request Forgery (Unauthenticated) BrightSign Digital Signage Diagnostic Web Server 8.2.26 - File Delete Path Traversal SpinetiX Fusion Digital Signage 3.4.8 - Database Backup Disclosure SpinetiX Fusion Digital Signage 3.4.8 - Cross-Site Request Forgery (Add Admin) SpinetiX Fusion Digital Signage 3.4.8 - Username Enumeration MonoCMS Blog 1.0 - Arbitrary File Deletion (Authenticated) WebsiteBaker 2.12.2 - 'display_name' SQL Injection (authenticated) GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting (Authenticated) CMS Made Simple 2.2.14 - Persistent Cross-Site Scripting (Authenticated) Typesetter CMS 5.1 - 'Site Title' Persistent Cross-Site Scripting Exhibitor Web UI 1.7.1 - Remote Code Execution
31 lines
No EOL
1.1 KiB
Text
31 lines
No EOL
1.1 KiB
Text
# Exploit Title: CMS Made Simple 2.2.14 - Persistent Cross-Site Scripting (Authenticated)
|
|
# Google Dork: -
|
|
# Date: 2020-09-29
|
|
# Exploit Author: Roel van Beurden
|
|
# Vendor Homepage: https://www.cmsmadesimple.org/
|
|
# Software Link: http://s3.amazonaws.com/cmsms/downloads/14793/cmsms-2.2.14-install.zip
|
|
# Version: 2.2.14
|
|
# Tested on: Linux Ubuntu 18.04
|
|
# CVE: CVE-2020-24860
|
|
|
|
|
|
1. Description:
|
|
----------------------
|
|
CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user
|
|
can get cookies from every authenticated user who visits the website.
|
|
|
|
|
|
2. Affected parameters:
|
|
----------------------
|
|
Content > Content Manager > Edit some page > Logic (tab) > Page Specific Metadata (text field)
|
|
Content > Content Manager > Edit some page > Logic (tab) > Smart data or logic that is specific to this page (text field)
|
|
|
|
|
|
3: Example payload:
|
|
----------------------
|
|
<script>alert(document.cookie);</script>
|
|
|
|
|
|
4: Exploitation demo:
|
|
----------------------
|
|
youtube.com/watch?v=M6D7DmmjLak&t=22s |