{"id":36794,"date":"2024-12-24T03:37:07","date_gmt":"2024-12-23T22:07:07","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=36794"},"modified":"2024-12-24T04:04:50","modified_gmt":"2024-12-23T22:34:50","slug":"cve-2024-50348-stored-xss-vulnerability-in-instantcms","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/vulnerability\/cve-2024-50348-stored-xss-vulnerability-in-instantcms\/","title":{"rendered":"CVE-2024-50348: Stored XSS Vulnerability in InstantCMS"},"content":{"rendered":"
\n\n

Product Name:<\/strong> InstantCMS
Vulnerability:<\/strong> Stored XSS
Vulnerable Version: <\/strong>2.16.2 & <2.16.2
CVE:<\/strong> CVE-2024-50348<\/p>\n\n<\/div>\n\n\n

The researchers from Astra\u2019s security team, on November 6, 2024, found a Stored Cross-Site Scripting (XSS) in InstantCMS, a free and open-source CMS that allows you to build websites. The vulnerability was identified in the photo album page’s photo upload function.<\/p>\n\n\n\n

A stored XSS vulnerability<\/a> occurs when an application allows malicious user input, is stored without proper sanitization, and is accessible to other application users.<\/p>\n\n\n\n

<\/span>CVE-2024-50348: Technical Breakdown<\/strong><\/span><\/h2>\n\n\n\n

How Was It Discovered?<\/strong><\/h3>\n\n\n\n

While testing on the demo app, Astra’s security researchers discovered that the uploaded images were not properly sanitized,d allowing the injection of malicious scripts along with the images.<\/p>\n\n\n\n

During the analysis, the <img><\/code> tag was used to embed the uploaded images with the XSS payload using the onerror<\/code> attribute.<\/p>\n\n\n\n

How To Recreate This Vulnerability?<\/strong><\/h3>\n\n\n\n

Inject Payload<\/strong><\/p>\n\n\n\n

Insert the following payload in the Camera Model Name metadata field:<\/p>\n\n\n\n

test<img src=\"asd\" onerror=\"alert(1)\"><\/code><\/p>\n\n\n\n

Submit Request<\/strong><\/p>\n\n\n\n

Upload the image on the photo upload page<\/p>\n\n\n\n

Observer Rendering<\/strong><\/p>\n\n\n\n