New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

There is stored XSS in version v2024.1000.4040 which can lead to stealing sensitive information of logged-in users #1183

Open

4everwl opened this issue Sep 10, 2024 · 0 comments

4everwl commented Sep 10, 2024

Software Link :https://github.com/magicblack/maccms10
Website : https://www.maccms.plus/
Vulnerable version v2024.1000.4040 download address ：https://github.com/magicblack/maccms10/releases/tag/V2024.1000.4040
After the installation is complete, log in as admin, open the page

Add a scheduled task.

Here you can fill in malicious JavaScript code to cause stored xss

Causes stored XSS to steal sensitive information of logged-in users

The second malicious code pops up

POC：

<script>alert(document.cookie)</script>
<script>alert(1)</script>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment