| शीर्षक | GreenCMS 2.3.0603 CWE-79 - Cross-site Scripting |
|---|
| विवरण | A stored Cross-Site Scripting (XSS) vulnerability was discovered in GreenCMS version 2.3.0603. The vulnerability originates from insufficient input sanitization in the "Link" parameter of the menu editor. Although the htmlspecialchars() function is used, the lack of the ENT_QUOTES flag results in the failure to escape single quotes ('). This allows an authenticated attacker to inject malicious JavaScript by closing the existing attribute with a single quote and injecting a new event handler. |
|---|
| स्रोत | ⚠️ https://gist.github.com/b1uel0n3/83f9965b3499a2abfee30c77458f718a |
|---|
| उपयोगकर्ता | b1uel0n3 (UID 93016) |
|---|
| सबमिशन | 27/11/2025 04:02 AM (10 महीनों पहले) |
|---|
| संयम | 08/12/2025 06:36 AM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 334754 [GreenCMS 2.3.0603 Menu Management Page CustomController.class.php लिंक क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|