POC详情： 5eaa8152f44e874392e1dae3fe8f7aa7741be814

来源
https://github.com/sromanhu/CVE-2023-44758_GDidees-CMS-Stored-XSS---Title
关联漏洞
标题： GDidees CMS 跨站脚本漏洞 (CVE-2023-44758)
描述：GDidees CMS是GDidees公司的一个建站系统。 GDidees CMS 3.0版本存在安全漏洞，该漏洞源于存在跨站脚本（XSS）漏洞。
描述
GDidees CMS 3.9.2 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title
介绍
# GDidees Stored XSS v3.0

## Author: (Sergio)

**Description:** Cross Site Scripting vulnerability in GDidees v.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Page Title.

**Attack Vectors:** Scripting A vulnerability in the sanitization of the entry in the Page Title allows injecting JavaScript code that will be executed when the user accesses the web page.

---

### POC:

We edit the "Outils d'édition" and see that we can inject arbitrary Javascript code in the "Titre de la page".


![image](https://github.com/sromanhu/GDidees-CMS-Stored-XSS---Titulo/assets/87250597/943ec358-f36b-4e3e-9f8f-e26447154da8)



### XSS Payload:

```js
'"><svg/onload=prompt('text')>
```


In the following image you can see the embedded code that executes the payload in the main web.
![image](https://github.com/sromanhu/GDidees-CMS-Stored-XSS---Titulo/assets/87250597/cac9aa1a-29e2-4403-abbd-918f3fa23d43)





</br>

### Additional Information:
https://www.gdidees.eu/cms-1-0.html

https://owasp.org/Top10/es/A03_2021-Injection/
文件快照

 [4.0K]  /data/pocs/5eaa8152f44e874392e1dae3fe8f7aa7741be814
└── [1.0K]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。