header-logo
Suggest Exploit
vendor:
CMS
by:
Shivam Singh
5.4
CVSS
MEDIUM
Stored Cross-Site Scripting (XSS)
79
CWE
Product Name: CMS
Affected Version From: 2.1.2001
Affected Version To: 2.1.2001
Patch Exists: NO
Related CWE: CVE-2022-34140
CPE: a:feehi:cms:2.1.1
Metasploit:
Other Scripts:
Platforms Tested: Linux, Windows, Docker
2022

Feehi CMS 2.1.1 – Stored Cross-Site Scripting (XSS)

Feehi CMS 2.1.1 is vulnerable to stored cross-site scripting (XSS). An attacker can inject malicious JavaScript code into the username field of the sign-up form. When a user visits any article page, the malicious code will be triggered and executed.

Mitigation:

Input validation should be used to prevent malicious code from being injected into the username field.
Source

Exploit-DB raw data:

# Exploit Title: Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS)
# Date: 02-08-2022
# Exploit Author: Shivam Singh
# Vendor Homepage: https://feehi.com/
# Software Link: https://github.com/liufee/cms
#Profile Link: https://www.linkedin.com/in/shivam-singh-3906b0203/
# Version: 2.1.1 (REQUIRED)
# Tested on: Linux, Windows, Docker
# CVE : CVE-2022-34140


# Proof of Concept:
1-Sing-up https://localhost.cms.feehi/
2-Inject The XSS Payload in Username:
"><script>alert(document.cookie)</script> fill all required fields and
click the SignUp button
3-Login to Your Account, Go to any article page then XSS will trigger.

Navigation

Suggest Exploit

Services By CQR