| 제목 | MuuCmf MuuCmf T6 cms 1.9.5.20260309 Improper Neutralization of Alternate XSS Syntax |
|---|
| 설명 | Link project: https://gitee.com/dameng100/muucmf
1/ Description:
Reflected Cross-Site Scripting (XSS) in MuuCmf T6 v1.9.5.20260309 allows a remote attacker to execute arbitrary JavaScript code in the context of the user's browser session via the keyword parameter to the channel/admin.Account/autoReply.html
CVSS score: 8.8 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
2/Technical details:
- Vulnerable Endpoint: /channel/admin.Account/autoReply.html
- Vulnerable Parameter: keyword
3/ POC:
Step 1: Inject the XSS payload to this URL: http://victim.com/channel/admin.Account/autoReply.html?keyword=<payload_here>
Step 2: Delivery the URL with XSS payload to admin
Step 3: The XSS payload will execute and can steal admin cookie. |
|---|
| 원천 | ⚠️ https://thinhneee.github.io/posts/muucmf-xss-channel/ |
|---|
| 사용자 | thinhnee (UID 96296) |
|---|
| 제출 | 2026. 03. 10. AM 10:33 (27 날 ago) |
|---|
| 모더레이션 | 2026. 03. 25. PM 03:51 (15 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 353151 [dameng100 muucmf 1.9.5.20260309 autoReply.html keyword 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|