IlchCMS 2.1.37 Cross Site Scripting

IlchCMS version 2.1.37 suffers from multiple cross site scripting vulnerabilities.

MD5 | 44643740a4ccbef00c29bdf57af23e23


Advisory by Netsparker
Name: Cross-Site Scripting in IlchCMS
Affected Software: IlchCMS
Affected Versions: 2.1.37
Vendor Homepage:
Vulnerability Type: Cross-Site Scripting
Severity: Important
Status: Fixed
CVSS Score (3.0): 7.4 (High)
Netsparker Advisory Reference: NS-20-003

Technical Details

Cross-site Scripting in Install Page

Parameter Name: URI-BASED
Parameter Type: Full URL
Attack Pattern: x%22+onmouseover%3dnetsparker(0x003370)+x%3d%22

Cross-site Scripting in Admin Panel


Notes: For successful exploitation, payload may need to be sent without URL
encoding. Modern browsers will encode the HTML tags in the request before
it is being sent to the webserver, however it is still possible in Internet
Proof URL:'"--></style></scRipt><scRipt>alert(0x0096E8)</scRipt>

Parameter Name: Query Based
Parameter Type: Query String
Attack Pattern: '"--></style></scRipt><scRipt>netsparker(0x0096E8)</scRipt>

For more information:


[image: upload image]
Daniel Bishtawi | Marketing Administrator
E: [email protected] <[email protected]>

Related Posts