sromanhu/cve-2023-43345-quick-cms-stored-xss---pages-contentQuick CMS 6.7 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Content- Name in the Pages Menu.
Description: A Cross-Site Scripting (XSS) vulnerabilitie in Quick CMS v6.7 allows a local attacker to execute arbitrary code via a crafted script to the to the Content - Name in the Pages Menu.
Attack Vectors: Scripting A vulnerability in the sanitization of the entry in the Nmae of Content of Pages Menu allows injecting JavaScript code that will be executed when the user accesses the web page.
When logging into the panel, we will go to the "Content - Name" section off Pages.
We edit that Content Settings and see that we can inject arbitrary Javascript code in the Name field.
<svg/onload=alert(document.domain)>
In the following image you can see the embedded code that executes the payload in the main web.
