Exploits / Vulnerability Discovered : 2021-08-05 |
Type : webapps |
Platform : php
This exploit / vulnerability Cmsuno 1.7 tgo stored crosssite scripting (xss) (authenticated) is for educational purposes only and if it is used you will do on your own risk!
CMSuno version 1.7 and prior is vulnerable to a stored cross-site scripting.
The attacker must be authenticated to exploit the vulnerability.
The payload injection is done while updating the template's image filename, vulnerable parameter is *tgo*
Steps to reproduce:
1. Go to /uno.php and click on *plugins*
2. Click on *Logo*
3. Choose a random picture in your files repo, click on save and intercept the request
4. Edit the POST request to /uno/template/uno1/uno1.php by modifying the tgo parameter's value to ")}</style><script>VULN JS CODE HERE</script>
5. Forward the request and click on *publish*
6. Click on *See the website*
7. XSS