sromanhu/cve-2023-44762_concretecms-reflected-xss---tagsCross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags
Description: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags.
Attack Vectors: Scripting a vulnerability in the sanitization of the entry in the Tags of "Settings - Tags" allows injecting JavaScript code that will be executed when the user accesses the web page.
When logging into the panel, we will go to the "Settings - Tags section off Dashboard Menu.
In the following image you can see the embedded code that executes the payload in the main web.
