关联漏洞
描述
Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Form of the Data Objects.
介绍
# ConcreteCMS Stored XSS v.9.2.1
## Author: (Sergio)
**Description:** Multiple Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.
**Attack Vectors:** Scripting A vulnerability in the sanitization of the entry in the Forms of "Data Objects" allows injecting JavaScript code that will be executed when the user accesses the web page.
---
### POC:
When logging into the panel, we will go to the "System & Settings - Express - Data Objects from section off Dashboard Menu and we select one.
Within the chosen Data object, we go to the Forms option:
We click on the "Add Form" option:
In the details of the form we choose "Add Field Set":
Next, we choose the + option to add data to the form field:
The vulnerability works with various fields, for example with "Core Properties - Text":
Finally we edit the content to add the payload:
### XSS Payload:
```js
<><img src=1 onerror=alert('Custom')>
```
We add the indicated payload in the "Custom Label" field:
In the following image you can see the embedded code that executes the payload in the main web.
As I have indicated, it works in different fields, such as the following:
</br>
### Additional Information:
https://www.concretecms.com/
https://owasp.org/Top10/es/A03_2021-Injection/
文件快照
[4.0K] /data/pocs/b52ca809e0d049b26cb7639f8d1a49af6f6359c1
└── [2.7K] README.md
0 directories, 1 file
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。