| 제목 | InstantCMS InstantCMS icms2 2.18.2 Cross-Site Scripting (XSS) |
|---|
| 설명 | Stored Cross-site Scripting (XSS) in the private-messages contact list of InstantCMS icms2 <= 2.18.2 (commit 3c7dd20e).
The inbox renders a contact's nickname into an HTML title attribute with raw echo, with no output escaping:
templates/default/controllers/messages/index.tpl.php (line 43)
templates/modern/controllers/messages/index.tpl.php (line 50)
<a ... title="<?php echo $contact['nickname']; ?>" ...>
Registration sanitizes only via strip_tags() (system/fields/string.php), which removes <...> but preserves " and '. A nickname such as:
x" onmouseover="alert(1)"
is stored verbatim and parsed as a second attribute on the same anchor when the victim opens /messages. All other nickname renderings escape via html(); this is the only unescaped sink.
PoC:
1. Register with nickname: x" onmouseover="alert(1)"
2. Send a PM to the target (POST /messages/send, contact_id=<target>)
3. Log in as target, open /messages, hover the contact row
4. alert() fires in the victim's session
Impact: XSS in any user's session incl. administrators. Session theft, account takeover, forced admin actions. Requires open registration (default) and enabled messenger. Payload persists before messenger is enabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N = 8.8 (High)
CWE-79
Vendor contacted: Yes ([email protected], 2026-08-29) |
|---|
| 사용자 | EVIL0RD (UID 100889) |
|---|
| 제출 | 2026. 08. 31. PM 06:05 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 10. PM 05:04 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416223 [InstantSoft icms2 까지 2.18.2 Private Message index.tpl.php index nickname 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 17 |
|---|