sromanhu/csz-cms-stored-xss---site-settingsCSZ CMS 1.3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Additional Meta Tag parameter in the Site Settings Menu.
Description: Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameter in the Site Settings Menu. Attack Vectors: Scripting A vulnerability in the sanitization of the entry in the Additional Meta Tag of "Site Settings" allows injecting JavaScript code that will be executed when the user accesses the web page and on the subpages.
When logging into the panel, we will go to the "Site Settings" section off General Menu [(http://localhost/cszcms/admin/settings)]
We edit that Site Settings that we have created and see that we can inject arbitrary Javascript code in the Additional Meta Tag field.
### Additional Information:
http://cszcms.com
https://owasp.org/Top10/es/A03_2021-Injection/
https://owasp.org/www-community/attacks/xss/