| Titre | Total.js CMS 10 Open Redirect |
|---|
| Description | Total.js Flow v10 (Flow 1.0.0, Total.js v5012) is vulnerable to Cross-Site Scripting (XSS) and Open Redirect. During page creation, the application allows content to reference files previously uploaded to the system (uploads). It was possible to upload images containing malicious payloads (SVGs with onload / <script> and HTML/meta tags for open redirect). When creating a page and referencing these images in the editor/layout, clicking the referenced image causes the file to be loaded and rendered inline by the browser, executing the stored payload. As a result, Stored XSS and Open Redirect can be triggered via user-uploaded files.
PoC:
Upload an image containing an XSS or Open Redirect payload. Then go to http://localhost:8000/admin/nav/, click Main > Create link > Browser files, and select the images with the payloads. In http://localhost:8000/admin/pages/, create the page and trigger the reference titles — this flow allows exploitation of Cross-Site Scripting (XSS) and Open Redirect vulnerabilities. |
|---|
| La source | ⚠️ http://localhost:8000/admin/pages/ |
|---|
| Utilisateur | Edcarlos (UID 53778) |
|---|
| Soumission | 30/09/2025 05:52 (il y a 1 Année) |
|---|
| Modérer | 12/10/2025 08:30 (12 days later) |
|---|
| Statut | Dupliqué |
|---|
| Entrée VulDB | 328072 [Total.js Flow SVG File élévation de privilèges] |
|---|
| Points | 0 |
|---|