Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Page Sign

[thinhneee]

Severity Score: Medium
CVSS score: 6.9
Vecto string: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Description:

Feehi CMS 2.1.1 allows authenticated user create the page but lack of santitize or filter input in the Page Sign. Leak to attacker can inject the XSS payload. It store the payload in the database.

Impact:

Attacker can inject the malicious Javascript into the website and can steal the cookie of victim.

POC:

Step 1: Create a new page.

Step 2: Enter the XSS payload into the Page Sign and save it.

Step 3: View the Page and see the payload is stored.

Mitigare:

1/ Use filters to filter tags or events.
2/ Implenment a whitelist in case you want to use certain tags.