Listen to this Post
The Grav content management system contains a reflected cross-site scripting vulnerability in the admin panel’s page editing functionality. Specifically, the GET endpoint `/admin/pages/[bash]` accepts user input via the `data[bash][content][bash]` parameter without proper sanitization. This parameter maps to the “Items” field in the Advanced Blog Config section when creating or editing a page. Attackers can inject malicious JavaScript payloads into this parameter, which are then directly reflected in the HTTP response. The application fails to validate or encode the input, allowing the script to execute in the victim’s browser. For example, the payload `”>` is inserted into the field, and upon page save or access via a crafted URL, the payload is rendered and executed. This vulnerability requires the victim to be authenticated as an admin, but if exploited, it runs scripts within the admin session. The attack leverages the lack of output encoding, where user-supplied data is embedded into the page without escaping HTML metacharacters. As a reflected XSS, the malicious payload is delivered via a URL, often through phishing. The execution context allows attackers to steal session cookies, perform actions as the user, or redirect to malicious sites. This vulnerability is critical due to its location in the admin panel, potentially leading to full site compromise.
Platform: Grav CMS
Version: Unspecified
Vulnerability: Reflected XSS
Severity: Critical
date: Unavailable
Prediction: Patch unknown
What Undercode Say:
Analytics
curl -G “http://target.site/admin/pages/test” –data-urlencode “data[bash][content][bash]=\”>”
Payload: “>
How Exploit:
Craft malicious URL
Phish admin user
Execute script session
Protection from this CVE
Input validation sanitization
Output encoding HTML
Content Security Policy
Impact:
Session hijacking theft
Unauthorized admin actions
Data compromise redirection
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
