| शीर्षक | Automad Automad CMS <= 1.10.9 Stored Cross-Site Scripting (XSS) |
|---|
| विवरण | Finding Name: Multiple Stored Cross-site scripting (XSS)
Description: It was discovered that the application does not validate user input and lacks implementation of sanitization for several parameters, leaving it susceptible to Cross-Site Scripting (XSS) attacks.
Affected Parameters:
General Data
- sitename
Default Template Setting:
- ogImage
- itemsHeader
- brand
- placeholderSearch
- iconNav
- itemsFooter
- SearchResults
Default Colors:
- colorPageText
- colorPageBackground
- colorPageBorder
- colorCardText
- colorCardBackground
- colorCardBorder
- colorCodeBackground
- colorNavbarText
- colorNavbarBackground
- colorNavbarBorder
Affected Files:
- packages\standard\templates\post.php (Line: 6, 22, 67, 76)
- packages\standard\templates\elements\navbar.php (Line: 19, 35, 65,
- packages\standard\templates\elements\icon_title.php (Line: 1)
- packages\standard\templates\elements\colors.php (Line: 1-10)
- packages\standard\templates\elements\colors_header.php (Line: 1-3)
Step To Reproduce:
1. Login to the application and navigate to the “General Data and Files” menu
2. Input the payload on the affected fields or parameter such as `<svg onload=alert("Sitename")// |
|---|
| स्रोत | ⚠️ https://github.com/screetsec/VDD/tree/main/Automad%20CMS/Stored%20Cross%20Site%20Scripting%20(XSS) |
|---|
| उपयोगकर्ता | Maland (UID 59886) |
|---|
| सबमिशन | 09/12/2023 06:07 PM (3 साल पहले) |
|---|
| संयम | 21/12/2023 09:19 AM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 248684 [automad तक 1.10.9 Setting post.php sitename क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|