XSS at file uploading in instantsoft/icms2
Valid
Reported on
Aug 14th 2023
Description
In menu Add page, there is a upload file function and xss payload can be injected there.
Detail:
1/ Access to the web demo and go to Add page menu.
2/ At upload file function, upload an file with filename is a payload xss.
3/ It will be triggered immediately.
Proof of Concept
Payload: "><img src=x onerror=alert(origin)>
Link video PoC: https://drive.google.com/file/d/1bgbbkTGhkKEYSVuQIyw58eKYjrW6pVc_/view?usp=sharing
Impact
Impact of Reflected XSS:
1/ The attacker can hijack user accounts.
2/ An attacker could steal credentials.
3/ An attacker could exfiltrate sensitive data.
4/ An attacker can steal cookies and Sessions.
We are processing your report and will contact the
instantsoft/icms2
team within 24 hours.
4 months ago
We have contacted a member of the
instantsoft/icms2
team and are waiting to hear back
4 months ago
The researcher's credibility has increased: +7
Thank you!
The researcher's credibility has slightly increased as a result of the maintainer's thanks: +1
to join this conversation