SeoChecker 1.9.2 Cross Site Scripting

2018.07.08
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

###################### # Author Information # ###################### Author : Ahmed Elhady Mohamed twitter : @Ahmed__ELhady Date : 01/07/2018 ######################## # Software Information # ######################## Affected Software : SeoChecker Umbraco CMS Plug-in Version: version 1.9.2 Software website : https://soetemansoftware.nl/seo-checker ############### # Description # ############### SeoChecker Umbraco CMS Plug-in version 1.9.2 is vulnerable to stored cross-site scripting vulnerability in two parameters which are SEO title and SEO description HTML parameters fields. A low privilege authenticated user who can edit the SEO tab parameter value for any Ubmraco CMS content like an article will be able to inject a malicious code to execute arbitrary HTML and JS code in a user's browser session in the context of an affected site. so when a high privilege user tries to access/edit the article content. the JS code will be executed. The vulnerabilities are tested on 1.9.2 version and Other versions may also be affected. ################# # Exlpoit Steps # ################# 1- Access the application with a low privilege authenticated user 2- Go to the SEO tab for any article 3-Enter the following payload in SEO title and SEO description HTML parameters fields parameters "><script>alert(123)</script> 4- Access the article content page to edit and change contents value. 5- The JS code will be executed.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top