| タイトル | Total.js CMS 10 Open Redirect |
|---|
| 説明 | Total.js Flow v10 (Flow 1.0.0, Total.js v5012) is vulnerable to Cross-Site Scripting (XSS) and Open Redirect. During page creation, the application allows content to reference files previously uploaded to the system (uploads). It was possible to upload images containing malicious payloads (SVGs with onload / <script> and HTML/meta tags for open redirect). When creating a page and referencing these images in the editor/layout, clicking the referenced image causes the file to be loaded and rendered inline by the browser, executing the stored payload. As a result, Stored XSS and Open Redirect can be triggered via user-uploaded files.
PoC:
Upload an image containing an XSS or Open Redirect payload. Then go to http://localhost:8000/admin/nav/, click Main > Create link > Browser files, and select the images with the payloads. In http://localhost:8000/admin/pages/, create the page and trigger the reference titles — this flow allows exploitation of Cross-Site Scripting (XSS) and Open Redirect vulnerabilities. |
|---|
| ソース | ⚠️ http://localhost:8000/admin/pages/ |
|---|
| ユーザー | Edcarlos (UID 53778) |
|---|
| 送信 | 2025年09月30日 05:52 (12 月 ago) |
|---|
| モデレーション | 2025年10月12日 08:30 (12 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 328072 [Total.js Flow 迄 673ef9144dd25d4f4fd4fdfda5af27f230198924 SVG File 特権昇格] |
|---|
| ポイント | 0 |
|---|