| 제목 | Redaxo CMS 5.18.1 Cross Site Scripting |
|---|
| 설명 | Stored XSS on REDAXO 5.18.1 - Article / "content/edit"
On the latest version of Redaxo, v5.18.1, the article name field is susceptible to stored XSS.
If a user creates an article name (ie /redaxo/index.php?page=structure&category_id=1&article_id=1&clang=1&function=edit_art&artstart=0) using a xss payload such as "<BODY ONLOAD=alert('XSS!')>", the XSS executes.
A malicious actor can easily steal cookie using this stored XSS and perform a session hijacking attack.
I have emailed in to the vendor at [email protected] and created a github advisory but did not get a response from either channels. Given that this is a popular CMS, it would be good to have a CVE out to inform users. |
|---|
| 원천 | ⚠️ https://geochen.medium.com/redaxo-cms-5-18-1-cross-site-scripting-7c9a872c72f6 |
|---|
| 사용자 | geochen (UID 78995) |
|---|
| 제출 | 2024. 12. 19. AM 11:12 (2 연령 ago) |
|---|
| 모더레이션 | 2025. 01. 08. PM 05:45 (20 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 290814 [Redaxo CMS 5.18.1 Structure Management Page Article Name 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 17 |
|---|