CVE-2023-44760: GitHub - sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes: Multiple Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a craf

ConcreteCMS Stored XSS v.9.2.1****Author: (Sergio)

Description: Multiple Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics.

Attack Vectors: Scripting A vulnerability in the sanitization of the entry in the Header and Footer Tracking Codes of “SEO & Statistics” allows injecting JavaScript code that will be executed when the user accesses the web page.

POC:

When logging into the panel, we will go to the “SEO & Statistics- Header and Footer Tracking Codes.” section off Dashboard Menu.

XSS Payload:

<img src=x:alert(alt) onerror=eval(src) alt=’XSS Header’>

<img src=x:alert(alt) onerror=eval(src) alt=’XSS Footer’>

In the following image you can see the embedded code that executes the payload in the main web.

We can use a payload to steal cookies and obtain them when a user logs on to the website in the two vulnerable fields.

Original session cookie.

Request captured with the external server:

Additional Information:

https://www.concretecms.com/

https://owasp.org/Top10/es/A03_2021-Injection/