| Titre | InstantCMS InstantCMS icms2 2.18.2 Cross-Site Scripting (XSS) |
|---|
| Description | Stored Cross-site Scripting (XSS) in the private-messages contact list of InstantCMS icms2 <= 2.18.2 (commit 3c7dd20e).
The inbox renders a contact's nickname into an HTML title attribute with raw echo, with no output escaping:
templates/default/controllers/messages/index.tpl.php (line 43)
templates/modern/controllers/messages/index.tpl.php (line 50)
<a ... title="<?php echo $contact['nickname']; ?>" ...>
Registration sanitizes only via strip_tags() (system/fields/string.php), which removes <...> but preserves " and '. A nickname such as:
x" onmouseover="alert(1)"
is stored verbatim and parsed as a second attribute on the same anchor when the victim opens /messages. All other nickname renderings escape via html(); this is the only unescaped sink.
PoC:
1. Register with nickname: x" onmouseover="alert(1)"
2. Send a PM to the target (POST /messages/send, contact_id=<target>)
3. Log in as target, open /messages, hover the contact row
4. alert() fires in the victim's session
Impact: XSS in any user's session incl. administrators. Session theft, account takeover, forced admin actions. Requires open registration (default) and enabled messenger. Payload persists before messenger is enabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N = 8.8 (High)
CWE-79
Vendor contacted: Yes ([email protected], 2026-08-29) |
|---|
| Utilisateur | EVIL0RD (UID 100889) |
|---|
| Soumission | 31/08/2026 18:05 (il y a 1 mois) |
|---|
| Modérer | 10/10/2026 17:04 (1 month later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 416223 [InstantSoft icms2 jusqu’à 2.18.2 Private Message index.tpl.php index nickname cross site scripting] |
|---|
| Points | 17 |
|---|