| शीर्षक | InstantCMS InstantCMS icms2 2.18.2 Cross-Site Scripting (XSS) |
|---|
| विवरण | Stored Cross-site Scripting (XSS) in the private-messages contact list of InstantCMS icms2 <= 2.18.2 (commit 3c7dd20e).
The inbox renders a contact's nickname into an HTML title attribute with raw echo, with no output escaping:
templates/default/controllers/messages/index.tpl.php (line 43)
templates/modern/controllers/messages/index.tpl.php (line 50)
<a ... title="<?php echo $contact['nickname']; ?>" ...>
Registration sanitizes only via strip_tags() (system/fields/string.php), which removes <...> but preserves " and '. A nickname such as:
x" onmouseover="alert(1)"
is stored verbatim and parsed as a second attribute on the same anchor when the victim opens /messages. All other nickname renderings escape via html(); this is the only unescaped sink.
PoC:
1. Register with nickname: x" onmouseover="alert(1)"
2. Send a PM to the target (POST /messages/send, contact_id=<target>)
3. Log in as target, open /messages, hover the contact row
4. alert() fires in the victim's session
Impact: XSS in any user's session incl. administrators. Session theft, account takeover, forced admin actions. Requires open registration (default) and enabled messenger. Payload persists before messenger is enabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N = 8.8 (High)
CWE-79
Vendor contacted: Yes ([email protected], 2026-08-29) |
|---|
| उपयोगकर्ता | EVIL0RD (UID 100889) |
|---|
| सबमिशन | 31/08/2026 06:05 PM (1 महीना पहले) |
|---|
| संयम | 10/10/2026 05:04 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 416223 [InstantSoft icms2 तक 2.18.2 Private Message index.tpl.php index nickname क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 17 |
|---|