OpenCMS 10.5.4 Cross Site Scripting

Alkacon OpenCMS version 10.5.4 suffers from a cross site scripting vulnerability.


MD5 | 8423f5be143ff3aca2de21f70e1be716

Download
Description: OpenCMS v10.5.4 and before is vulnerable to cross site
scripting in New User module for parameter First Name and Last Name

Impacted URL is
http://[your_webserver_ip]/opencms/system/workplace/admin/accounts/user_new.jsp

Payload used in PoC is "TestXSS<img+src=x+onmouseover=alert(document.domain)

Further details is available here
https://github.com/alkacon/opencms-core/issues/635

Already requested for CVE, yet to receive it.



Source: packetstormsecurity.com
Related Posts