Concrete CMS · Report #50564
Stored XSS in Contact Form
Validstatus
3upvotes
8 Jul 2015disclosed
How it was found
In Contact form there is an option to display Message when completed. There I have put the payload payload: "><img src=x onerror=alert(1)>
and the payload executed and saved permanently.