Backdrop CMS 1.23.0 Cross Site Scripting

2024.03.20
Credit: Sinem Sahin
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

# Exploit Title: Backdrop CMS 1.23.0 - Stored Cross-Site Scripting - Post Body Field # Date: 2023-08-21 # Exploit Author: Sinem ┼×ahin # Vendor Homepage: https://backdropcms.org/ # Version: 1.23.0 # Tested on: Windows & XAMPP ==> Tutorial <== 1- Go to the following url. => http://(HOST)/backdrop/node/add/post 2- Write your xss payload in the body of the post. Formatting options should be RAW HTML to choose from. 3- Press "Save" button. XSS Payload ==> "<script>alert("post_body")</script>


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top