| 标题 | Total.js CMS v19.9.0 Cross Site Scripting |
|---|
| 描述 | In CMS Total.js v19.9.0, a stored Cross-Site Scripting (XSS) vulnerability was identified that was exploitable through the file upload functionality available in the “Files” menu.
An authenticated attacker with administrative privileges can upload malicious files by manipulating the Content-Type to text/html and using arbitrary file extensions (e.g. .html). This way, it is possible to upload files containing injected JavaScript code.
As a proof of concept, an HTML file containing the following payload was uploaded:
<script>window.location.href='https://www.google.com/'</script>
When accessing the file hosted on the CMS, the JavaScript code is executed in the victim's browser, causing automatic redirection to a domain controlled by the attacker. The impact may include phishing and performing other malicious actions in accordance with the attacker's goals.
PoC example:
http://x.x.x.x:8000/download/JBMVZC1c561f.html?download=1
This behavior demonstrates that any user who accesses the malicious URL will have JavaScript code executed in their browser, allowing the attacker to exploit XSS for different purposes.
I will leave the PoC URL in the Consulting/Exploration field. If you do not agree, please let me know so that I can adapt as expected. Thank you in advance. |
|---|
| 来源 | ⚠️ http://x.x.x.x:8000/download/JBMVZC1c561f.html?download=1 |
|---|
| 用户 | mirandaBR (UID 90010) |
|---|
| 提交 | 2025-09-09 20時46分 (1 年前) |
|---|
| 管理 | 2025-09-26 08時59分 (17 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 325962 [Total.js CMS 直到 19.9.0 Files Menu 跨网站脚本] |
|---|
| 积分 | 20 |
|---|