This exploit demonstrates a stored XSS vulnerability in Fork CMS 5.4.0 via the /backend/ajax endpoint. The payload injects HTML and JavaScript through the 'url' parameter in a POST request, leveraging improper input sanitization.
Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target:Fork CMS 5.4.0
Auth required
Prerequisites:Access to the backend interface · Valid session cookies