Module library
Ethical Hacking Automation
Automate Recon and scanning process with Vidoc. All security teams in one place
Concrete CMS <8.5.2 - Cross-Site Scripting
By kannthu
High
Vidoc Module
Vidoc Module#hackerone#concrete#xss#cms#unauth
Description
Author: shifacyclewla,hackergautam,djoevanka
Classification
CWE-ID: CWE-79
CVSS-Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS-Score: 7.2
Concrete CMS before 8.5.2 contains a cross-site scripting vulnerability in preview_as_user function using cID parameter.
Reference
- https://hackerone.com/reports/643442
- https://github.com/concrete5/concrete5/pull/7999
- https://twitter.com/JacksonHHax/status/1389222207805661187
Metadata
max-request: 1
Module preview
Concurrent Requests (1)
1. HTTP Request template
GET/ccm/system/panels/p...
Matching conditions
word: </iframe><svg/onload=alert("{{randstr}}"...and
word: text/html, CONCRETE5and
status: 200
Passive global matcher
No matching conditions.
On match action
Report vulnerability