Submit #466396: Redaxo CMS 5.18.1 Cross Site Scripting
| Title | Redaxo CMS 5.18.1 Cross Site Scripting |
|---|---|
| Description | Stored XSS on REDAXO 5.18.1 - Article / "content/edit" On the latest version of Redaxo, v5.18.1, the article name field is susceptible to stored XSS. If a user creates an article name (ie /redaxo/index.php?page=structure&category_id=1&article_id=1&clang=1&function=edit_art&artstart=0) using a xss payload such as "<BODY ONLOAD=alert('XSS!')>", the XSS executes. A malicious actor can easily steal cookie using this stored XSS and perform a session hijacking attack. I have emailed in to the vendor at info@redaxo.de and created a github advisory but did not get a response from either channels. Given that this is a popular CMS, it would be good to have a CVE out to inform users. |
| Source | ⚠️ https:/ |
| User | geochen (UID 78995) |
| Submission | 19.12.2024 11:12 (vor 3 Monaten) |
| Moderation | 08.01.2025 17:45 (20 days later) |
| Status | Akzeptiert |
| VulDB Entry | 290814 [Redaxo CMS 5.18.1 Structure Management Page Article Name Cross Site Scripting] |
| Points | 17 |