sromanhu/cve-2023-44765_concretecms-stored-xss---associationsCross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Plural Handle of the Data Objects from System & Settings
Description: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.
Attack Vectors: Scripting A vulnerability in the sanitization of the entry in the Plural Handle of "Data Objects from System & Settings" allows injecting JavaScript code that will be executed when the user accesses the web page.
When logging into the panel, we will go to the "System & Settings - Data Objects." section off General Menu.
We edit the Entity field with the payload that we have created and see that we can inject arbitrary Javascript code in the Plural Handle field.
""><svg/onload=alert('PluralHandle')>
Then we add an association:
And we add the Type to Many to Many to add the payload to "Target Property Name and Inversed Property Name":
We execute the association created:
In the following image you can see the embedded code that executes the payload in the main web.
