HAX CMS 24.x - Stored Cross-Site Scripting (XSS)

ExploitDBExploitDB exploitExploitEDB-52526

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to a HAX CMS instance and uploads an HTML file containing arbitrary JavaScript, demonstrating stored XSS (CVE-2026-22704).

Backdoor review

No backdoor observed in reviewed code

The PoC script is a straightforward stored XSS demonstration against HAX CMS. It logs in, uploads an HTML file containing a user-chosen JavaScript payload, and prints the URL. No backdoor, deceptive payload, or concealed operator-directed harm is present.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwareHAX CMS
Attack typesstored cross-site scripting
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads a crafted HTML file containing executable JavaScript to a vulnerable endpoint, which constitutes exploitation of the stored XSS vulnerability rather than mere detection or scanning.

exploits/multiple/webapps/52526.py:1-135

Requirements

  • Low-privileged authenticated user credentials for the target HAX CMS instance.exploits/multiple/webapps/52526.py:14
  • Target HAX CMS version <= 24.x with file upload functionality enabled.exploits/multiple/webapps/52526.py:9

Observed behavior

  • Logs into the target HAX CMS instance using provided credentials.exploits/multiple/webapps/52526.py:69-78
  • Generates an HTML file containing a JavaScript payload (alert, cookie, or custom).exploits/multiple/webapps/52526.py:30-63
  • Uploads the malicious HTML file to the /files/upload endpoint.exploits/multiple/webapps/52526.py:86-92
  • Outputs the URL where the uploaded HTML file can be accessed to trigger the XSS.exploits/multiple/webapps/52526.py:98-101
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Generation
The script generates an HTML file with a JavaScript payload chosen by the user via --payload (alert, cookie, or custom).The payload is user-supplied and intended for XSS demonstration; no hidden or malicious payload is embedded.exploits/multiple/webapps/52526.py:30-63
Authentication
The script authenticates to the target HAX CMS instance using provided credentials.Authentication is required for the exploit; credentials are passed as command-line arguments, not hardcoded or exfiltrated.exploits/multiple/webapps/52526.py:66-82
File Upload
The script uploads the generated HTML file to /files/upload on the target.This is the core exploit step; no additional files or payloads are uploaded.exploits/multiple/webapps/52526.py:86-101
Review boundaries

What the analysis did not establish

  • Analysis based solely on static code review; script was not executed.
  • No network traffic or runtime output captured to confirm successful exploitation.
  • Relies on assumptions about the target application's upload endpoint and file serving path.
  • Only the supplied text file was reviewed; no binary analysis was performed.
  • The script's behavior depends on the target server's response; no server-side analysis was conducted.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1