There is a stored XSS vulnerability

baigoStudio / baigoCMS

网站内容管理系统

http://www.baigo.net/cms/

Apache License 2.0

98 stars 36 forks source link

There is a stored XSS vulnerability #7

Open MRdoulestar opened 5 years ago

MRdoulestar commented 5 years ago

Vulnerability description

A xss vulnerability was discovered in baigoCMS. There is a persistent XSS attacks vulnerability which allows remote attackers to inject arbitrary web script or HTML via the form(opt[base][BG_SITE_NAME]) parameter post to the /baigocms/bg_console/index.php?m=opt&c=request

poc

xss payload:
<img src=# onerror="alert(1)">

NicoleG25 commented 3 years ago

@fonering is there a plan to address this vulnerability ? Please note that CVE-2019-9226 was assigned to this. Thanks in advance !