Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Category

[thinhneee]

Severity Score: Medium
CVSS score: 6.9
Vecto string: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Description:

Feehi CMS 2.1.1 allows authenticated user create the new category but lack of santitize or filter input in the category name. Leak to attacker can inject the XSS payload. The category name appears in multiple places (home page, articles, and article categories).

Impact:

If user or admin click to the places where contain the category with stored XSS payload, attacker can steal the cookie of the victim.

POC:

Step 1: Create a new category.

Step 2: Create new article with malicious category.

Step 3: View the places where contains malicious category.

Article contains malicious category:

Home page::

Category Articles: