sromanhu/wbce-cms-stored-xss---pages-menuWBCE CMS 1.6.1 is affected by a cross-site stored scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a payload crafted in the Intro Page parameter in the Pages menu.
Description: WBCE CMS 1.6.1 is affected by a Cross-Site stored scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a payload crafted in the Intro Page parameter in the Pages menu. The payload will be executed on the main page independent of the user's session, so accessing the home web with another user will also execute the payload.
When logging into the panel, we will go to the "Modify Intro Page" section off Pages [(http://localhost/wbce/wbce/admin/pages/index.php)]
We edit the body configuration where we add the XSS payload:
<svg onload=alert(1)> "><svg onload=alert(1)// "onmouseover=alert(1)// "autofocus/onfocus=alert(1)//
In the following image you can see the embedded code that executes the payload in the main web:
When clicking on "View Site" or accessing the home page, the payload is executed:
If we log in with another user, the payload also skips:
