sromanhu/cve-2023-43353-cmsmadesimple-stored-xss---news---extraCross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Extrain the Content - News Menu.
Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Extra in the Content - News Menu.
Attack Vectors: Scripting A vulnerability in the sanitization of the entry in the Extra of "Content - News Menu" allows injecting JavaScript code that will be executed when the user accesses the web page.
When logging into the panel, we will go to the "Content- News" section off General Menu.
We edit that Content - News Menu with the payload that we have created and see that we can inject arbitrary Javascript code in the Extra field.
'"><svg/onload=prompt('Extra')>
In the following image you can see the embedded code that executes the payload in the main web.
