Concrete CMS · Report #30019

Stored XSS in concrete5 5.7.0.4.

Validstatus

3upvotes

11 Mar 2015disclosed

How it was found

Hello.

I found stored XSS in concrete5 5.7.0.4.

If the user have file upload permission the user can upload the file named like "><svg onload=confirm(document.cookie)>.txt and the file name is displayed without being escaped.

and when other user access the file manager page, Execute Javascript code on page load.

Regards.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original