| शीर्षक | Automad Automad flat-file CMS 2.0.0-alpha.37 Stored Cross Site Scripting |
|---|
| विवरण | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Automad flat-file CMS, version 2.0.0-alpha.37. The "Brand" field under the general settings section fails to sanitize user input properly. An attacker can inject malicious JavaScript code which is stored and later executed in the context of the application when the public page is accessed.
Affected Component: "Brand" field in General Data and Files
HTML Element: <textarea id="am-field__brand" name="data[brand]">...</textarea>
Vulnerable Endpoint: /dashboard/shared?section=settings
Test Payload: <script>alert('PoC VulDB Automad CMS')</script>
Steps to Reproduce:
1 - Go to the admin panel: /dashboard/page
2 - Navigate to “General Data and Files”
3 - Inject the payload in the Brand field
4 - Click Publish
5 - Visit: /demo/{page-id}/
The payload is executed, confirming the stored XSS |
|---|
| स्रोत | ⚠️ https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README5.md |
|---|
| उपयोगकर्ता | RaulPACXXX (UID 84502) |
|---|
| सबमिशन | 14/06/2025 11:35 PM (1 वर्ष पहले) |
|---|
| संयम | 15/06/2025 03:29 PM (16 hours later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 248684 [automad तक 1.10.9 Setting post.php sitename क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|