sromanhu/cve-2023-43342-quick-cms-stored-xss---languages-frontendQuick CMS 6.7 è vulnerabile a una falla di Cross-Site Scripting (XSS) che consente agli aggressori di eseguire codice arbitrario tramite un payload appositamente creato nelle pagine Frontend del menu Lingue.
Description: A Cross-Site Scripting (XSS) vulnerability in Quick CMS v6.7 allows a local attacker to execute arbitrary code via a crafted script to the to the Front and back end - Pages in the Languages Menu.
Attack Vectors: Scripting A vulnerability in the sanitization of the entry in the Pages of "Languages- Front and back end" allows injecting JavaScript code that will be executed when the user accesses the web page.
When logging into the panel, we will go to the "Languages - Front and back end ." section off General Menu.
We edit that Front and back end Settings and see that we can inject arbitrary Javascript code in the Pages field.
'"><svg/onload=alert('Pages')>
In the following image you can see the embedded code that executes the payload in the main web.
