Alkacon OpenCMS version 10.5.4 suffers from a cross site scripting vulnerability.
2b12a0da062bae30a6ab0d3846368a2e54506ffbbb0fac39965521183d979953Description: OpenCMS v10.5.4 and before is vulnerable to cross site
scripting in New User module for parameter First Name and Last Name
Impacted URL is
https://[your_webserver_ip]/opencms/system/workplace/admin/accounts/user_new.jsp
Payload used in PoC is "TestXSS<img+src=x+onmouseover=alert(document.domain)
Further details is available here
https://github.com/alkacon/opencms-core/issues/635
Already requested for CVE, yet to receive it.
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed