Concrete CMS · Report #4808
/index.php/dashboard/sitemap/explore/ Cross-site scripting
Validstatus
4upvotes
9 Jun 2014disclosed
How it was found
Hi,
When you go to /index.php/dashboard/sitemap/explore/ and press on blog (I had standing Blog there) and then on properties -> Custom Attributes -> tags and insert "><img src=x onerror=alert(4)> a XSS will popup.
Some screens are in the attachment.
Best regards,
Olivier Beg