linan-oo/cve-2026-52307Proof-of-concept for CVE-2026-52307, an authenticated stored XSS in 1CMS v5.6 Column Management, with reproduction steps and impact analysis.
This repository contains the reproduction of CVE-2026-52307, an authenticated stored cross-site scripting (XSS) vulnerability discovered in 1CMS v5.6 (formerly ClassCMS).
A proof-of-concept (PoC) is provided to demonstrate the vulnerability in a local environment, including detailed description, reproduction steps, and impact analysis.
An authenticated stored cross-site scripting (XSS) vulnerability exists in the Column Management component of ClassCMS 1CMS v5.6. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the title field.
The vulnerability is remotely exploitable over the network. An authenticated administrator can inject arbitrary JavaScript into the article title field via the page. When other users view the article list or detail page containing the malicious title, the injected script executes in their browsers.
Note: ClassCMS has been officially upgraded to 1CMS. The vulnerable version is 1CMS v5.6[reference:0].
The injected JavaScript (alert('XSS')) executes in the browser of any user viewing the affected page, confirming the stored XSS vulnerability.
Arbitrary script execution in the context of the victim's browser
Session hijacking – attackers can steal session cookies
Information disclosure – sensitive data can be exfiltrated
Phishing attacks – malicious content can be injected to deceive users
Defacement – the appearance of the CMS can be altered
A full PoC is available in this repository. To reproduce:
Set up a local 1CMS v5.6 instance
Follow the reproduction steps above
Observe the XSS execution
Upgrade to the latest version of 1CMS if a patch is available
Implement proper input sanitization and output encoding for all user-supplied data
Restrict administrator access to trusted users only
Consider using Content Security Policy (CSP) headers
