This repository was archived by the owner on Sep 18, 2024. It is now read-only.
This repository was archived by the owner on Sep 18, 2024. It is now read-only.
Stored XSS in profile page #797
Description
Description:
Cross-site scripting (XSS) vulnerability in Gleez CMS allow remote attackers (users) to inject arbitrary Javascript or HTML via the profile page editor, which will result in a Stored XSS on his public profile.
Vulnerability Type: Stored XSS
Attack Vectors:
- Go to your profile page editor https://demo.gleezcms.org/user/edit
- Set your home page URL to :
http://x.x/<svg >
Now when someone will check your profile page, alert(document.cookie) will be executed.