DaiCuoCms version 1.3.13 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. An authenticated user with access to the admin panel can inject malicious JavaScript code into article content or other editable fields. This code is then rendered and executed in the context of users who visit the affected frontend pages, potentially leading to session hijacking, phishing, or other malicious actions. The lack of proper input sanitization and output encoding makes this vulnerability exploitable.
Login to the admin panel using the default credentials:
Username: admin
Password: admin888
Navigate to the SEO Optimization settings section.
Inject the following payload into a field such as the site title or description:
"><img src=0 onerror=alert(1)>
Save the changes and visit the homepage.
The malicious script will execute, confirming the XSS vulnerability.
Payload Execution on Homepage:
Vulnerability Verification:
DaiCuoCms version 1.3.13 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. An authenticated user with access to the admin panel can inject malicious JavaScript code into article content or other editable fields. This code is then rendered and executed in the context of users who visit the affected frontend pages, potentially leading to session hijacking, phishing, or other malicious actions. The lack of proper input sanitization and output encoding makes this vulnerability exploitable.
Login to the admin panel using the default credentials:
Username: admin
Password: admin888
Navigate to the SEO Optimization settings section.
Inject the following payload into a field such as the site title or description:
"><img src=0 onerror=alert(1)>Save the changes and visit the homepage.
The malicious script will execute, confirming the XSS vulnerability.
Payload Execution on Homepage:
Vulnerability Verification:
