sromanhu/cve-2023-41436-csz-cms-stored-xss---pages-contentCSZ CMS 1.3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Additional Meta Tag parameter in the Pages Content Menu.
CVE: 2023-41436
Description: Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameter in the Pages Content Menu component.
Attack Vectors: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS3 Score: 5.4 - MEDIUM
When logging into the panel, we will go to the "Pages Content" section off General Menu [(http://localhost/cszcms/admin/pages)]
We edit the Content of /home and see that we can inject arbitrary Javascript code into the Additional Meta tag field.
### Additional Information:
http://cszcms.com
https://owasp.org/Top10/es/A03_2021-Injection/
https://owasp.org/www-community/attacks/xss/