HexBrain

Concrete CMS · Report #50564

Stored XSS in Contact Form

Validstatus
3upvotes
8 Jul 2015disclosed

How it was found

In Contact form there is an option to display Message when completed. There I have put the payload payload: "><img src=x onerror=alert(1)>

and the payload executed and saved permanently.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original