Backdrop CMS version 1.23.0

Vulnerability Explanation:

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Post content.

Attack Vectors:

The attacker must post something on the "Post content" and insert the XSS payload at the "Body" input, and pick the Raw HTML Editor in order to exploit the stored XSS. The XSS payload will be launched immediately after save.

Affected:

• http://ip_address/backdrop/node/add/post

• POST /backdrop/node/add/post

Payload :

• ``

Tested on:

1. Backdrop CMS version 1.23.0 (https://github.com/backdrop/backdrop/releases/tag/1.23.0)

2. Firefox version 105

Steps to attack: