CVE-2023-36217
CRITICALXoops CMS 2.5.10 - Stored Cross-Site Scripting via Image Manager Category Name Field
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2023-36217. PoCs published by tmrswrr.
AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Xoops CMS 2.5.10, where an authenticated attacker can inject malicious JavaScript via the Image Manager's 'Add Category' feature. The payload executes when hovering over the injected category name in the multiupload interface.
Description
Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 allows a remote attacker to execute arbitrary code via the category name field of the image manager function.
Exploits (1)
This exploit demonstrates a stored XSS vulnerability in Xoops CMS 2.5.10, where an authenticated attacker can inject malicious JavaScript via the Image Manager's 'Add Category' feature. The payload executes when hovering over the injected category name in the multiupload interface.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H