/Pluck-CMS-Stored-XSS---Installation

pluck CMS 4.7.18 is affected by a Multiple Stored Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the cont1 and cont2 parameters in the installation process- Website Name that will appear both pop-ups on the main page.

Pluck CMS 4.7.18 Stored XSS

Author: (Sergio)

Description: Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of PluckCMS v.4.7.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the cont1 and cont2 parameters in the installation process- Website Name.

Attack Vectors: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

POC:

During the installation process we enter the XSS payload in any of the 2 parameters and when we click on next, we will obtain the XSS pop-up

XSS Payload:

<img src=x:alert(alt) onerror=eval(src) alt='XSS Page'>

In the following image you can see the embedded code that executes the payload in the instalaltion process. XSS Installation

And below is evidence of the execution of the payload when accessing the main website: XSS Resultado


Additional Information:

https://github.com/pluck-cms

https://owasp.org/Top10/es/A03_2021-Injection/