Security Research
CVE-2023-43341 Evolution CMS Reflected XSS: Reflected Attack Surface in the Admin Panel
Thinking
2023-09-15
3 min read
Research Dossier
#Vulnerability Analysis#Code Audit#Web Security
Evolution CMS lacks escape on multiple parameters in the admin panel — URLs crafted by attackers directly trigger XSS when an admin clicks them, giving full backend control.
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a4d4b6d4ade7253d06d61bf923572a6b8c253d117e8b63642be9ad8c68eaee7d4a02592bcdbd3155abcc6a953135deec61ed6729ad92ae056a76758bfc9dbe3a6985cd89376c1f15f2351ad5bb4a1f33e726079085334483bca14fd6e1eec1422d57933def9e9d5b9e185841708402ca1643d0748c0c7385d519ab753027a428b394facb016580c5a3aea16bee81642e4265564626ea40a35f7fff0985f3e0d136ce0836a03eb3555c2e2152667e910878029a2941067b937719c9ebc0373ffbf8a84b21883d89a1c977e87bcad6dfede874fef1fdf44b0cc7b722a1556916d03035fb8e45c71300f3790c3a535d790236bdbfce86bc72e8918b1f228cc684201f04dc53b08838c57c529e9f50a5acab05af569d657e588bea6d934520a686aa3064f1826bb9d20ae532a830ca74a2ba4623ce33a424e3a4b194b4ebf9f09df58be44e02565cc2c8bb0044a0ecca46978e622166f0946bb837a6cbb72957757be4ff625bdfd0c95dcc360ea7a6980055443ccd9929c5b8ad6d44b0f859da294f57b8cb8f705652b398ffd2324b2a73216c8089af145ef974dbbcec013740722e34bfdff6ea1a9b67ff1937c8d35652812b72971b5932ddb7534af4c6f36671297ea6cdcaccf5d8b35ec160d5197f19dc14e8ab286827bee681adf1da4f6d6bc16f599285b233d00d8ab61b980d95bdc2558b9e4d274728f4d5ebcb8b4c566dc75cf53ac7b252da92168c54a702909bdb76b67a2a7ebdb5a7e039afb6fa6b092dae7d419207637cb9444a5c30ccd644bf7a60786a0d0a372d641aacc0c734dee45539bf7e3ae73092fcaba24c9d86798730b641df9be8ba08ef9fe59910e7e01c3916429e61244509c66a320a8ab156d4da21fd2558bf7de6e88c361b154b29cf4415250a69af9ae9f5322aeabcd7e82b626b465097b6241517f65434df9b78630fe72dfdafe9df19d3739897fda5b258ad3aa51f6dcc08668e2ad7469b898d80405628412c8158b892d2768d829545cbbc3a390a2d96030f7277e4969649486452068c03526f531d2a18e7d0e69d46700e59eb56168392955ac880707c8a9b9301dbbaff6c5ce61349fb266360bf721cdb2dbcc6a1eeacf41500c8a88e392ef8f55e78ded1991f382bd2475d7c99f3a2fe7f723ee12cf054fda2a7a36ad3a576784985290c0dd1bd4a0eef9fd75a7c39ba83696d7670aef34baf8621f11b183f7b4dd256dbaa1e45daf0808a0d08c0f95262383c45a78d8b623f97ea9f1730074dabdc5747791251776b304e4e197b414a8e68d09d7d2a88add84ef65aff1c79c15320d142dbe28ba7e3065076cbb2e82e8a907a510bc06c1d30b432cb6e62741d0e6d7d8af11e4a8e70e8642037434888f5fd145e0bd34fc35a1fd666b071c1d28acdee66270aa831d4e5b46d26566de6f3d6133f33d5107fa201c24e98384ca70b3a1664a5975128e7d834ebc1d7e4c0a29f1afe2d16fa149482e3281febbf182c477e602690cc962561971f07f6ae6e4ca0efaf13a470f03a3ca6e019299a273d358e21590f9d747d9b9f27798e6336497a17e0987717db22dd0d3dfc8d6d1effa81cf960a9d0b6a32ed6c4a5371348373ad3dc79b2a5c7611d2872104ad1109a8b4767dd796216b7b7a538c28baa3fd1e57ca3f651e612aea503c018c11e65c3c2a30786a1ad4b5cdac375a6e5f4f29544ab5b718ee836ed22f8cfdbd51742a50a57eef616569657e278da8d14ec55e45cb56a1e119ad61068547c072769a02d60a00af0658a7ac8e6357777bfbfcae055680e6f78b805190be38b3f9af3150cab8feaacb1969190c0c2058395e32508eaf93992f77d103ddf39ccdb1b08f91e875438a43deaaa7dda2313135ed8b4f944ae6a4c4313605820e18c30667ded0177562b21f4e8e7482178213b9a1ebc7f00b612b4ff26227453e36e8cdfcc1385887571c79094962514a663d883db92e3b1004cf2228dc66401a5838379a15d0775f713714ecb46f97e9a137067ce7568e2a0dce058c2ce17501af3e6dbaeec9677933f9e2f50cd980468890e78a46f93ee9073334064ed50205f0c7472c7f7cd764d486f0c7d066885cd42283659dcc29c69c473704c21d45377b4d91f2aa12c743058da454b565293f0f4e929105fc2144293a63c3315051071af374e3d83479850ebb91af2345b04969f5599343eb2c98fc4bc4fa7b89cf311b51062ec032068d323683eb05d5fc2cbbd80142c82cfdaaaaee9c946e83adad285ad9362d021f7d9eef80fa3227a75ce4a21cb8e474e673f63940fbd2715b5a27c499cbbc2b45f50394a8c02bbd0606b756b2f6488bb6c6cc8d30fb1f52ac96a231b6d52ab41a9b073b2169d3cf4b0ef2ee12392f56053327e16d1936c2bcae77c8c3fdba3176fb9bccbf22e1a2ee445e0ce90800cf6feb4049361df89abb2681c3cbfdc1f1c583d119efad9af8d65da8173d43184c5c14ad071b161050fd661f99b7f385687c3c734fa5c5a7e3c7b8c3df23b7801982f510f05ff558223750efad7b003f903073dfc03361f3fa5b7127c956cbd7b8c106bd0b7d6b0d12e57dc8822e0b6429e988e00a950d42f5a7b5db548abcfe777d6ee0260d1d4e9671ff0f33fcfc2d9894f591ced4cdd4e7cd5334c02252d62e2d5a6df6ba7b6606b91e862146bba5ff48f62974148e0a5ba5641cac193eef9ae9774cc7d0569093bf6d331ee15952bbf5553a376c5a7668ac4c3cff40024e89254648fe811182663d020717838eef40e3377bae792bac17a6ead46dfc537f950b537f5495d31151eb74454c99658c0d30c5ced819454f8a3967cd3d553196d77bc5602f35c9616f88e49684d9fe4b5a0b89d0e0495702b6bb40c61f91e675a3ba4f4636106d2194db57cbb8745e655d526995fc49e1dce6e7fdd6b4f2fa41ea5a7e743dbc60f0a8f7b298bcde160a218cf14cc7aa05366951e4888e552a2ebe51f6e67892e6d94655acd8a7982ab7f9fb061753487aade6e324ca450bba1214cdbc91b415b4a5b1ca5ae89b8021e4742935d72ac36961487426ea88cbb913573b3b777de5d38025172465a50111fb4fe9941a8cc5391c33be132fd56df6782de7bbfb790d669673a181be1417b19d4b9c1167acf9a23cb7f9ec39904e127d3215299b066038dcfcd6e719b18cc633249c42e523e6522f4d8da3c3994d8fc75578c13b15d6d223ba7f20fa121ee97e8c142078cda4323266b4a87baca1e2dcab5205b9b65102923d2c4c5bd1a283914aa00375cec704381bfbd3602cdf04bbd01b7730f3850ee33ae6c432c5d94f723629924716b209a0753dfd48f45942ae37da6a3b9202fcc1e1011f3c55259f3ca9f82733c09108308eeb93835d0c627d7126143e8163c69445977013a3d45e5521391f11d0ebca1fe8ab9d6a3a11004356e6a75aefbec563640b466ecfef029d56a2e68cf67410b2a63fc9691b6e675c459cbe2ea5befc0c877c33c37dda0151ad1cfc53f70ee40a68fe1c063f5145ce71c996aac65aa2134d33935d0dcf1e12a6979846c9cddd2198c0d98dd856c3b4d6afa0819a61dae446a909227d47b282a64b2ea123e0dced8bb8f0a215e19bdddc304ecf2c5e7bfcb22e654b6cf9f6a6e8b1ca1975ee19dce8ee648b5b104c0a06853d9a6d0e991929b6e4a82286db369b1b2fe0c2c12b1ab2500e6b1dddf66643093dacdb731433279b05d010f637afc609d64502a2e8d1d656330f6e4743f7826981d4d747442aa30e5b7b6d8f891f4298851fbb89608335e9ba58996d921eca2a2b0ec66cd7b9de3852c95f53c11f86ddb635eaff47bd265975478294b711ffa919b516c9e166c3542cfd43e53ead23e298ac49c74af6193d6a6f231936b8312d2a64d8fc77f1502337a6b04e40e9f7ac62d5f4ec128dfcdbc9786ab6b678720dc3f3a94bee55ff35101dcbbaf2564bdb85b24609d003224e62f443a446a8c7addc49b1d8ed78154da41d8bd6772905c970a9baa945dfe776b7b17d0da1c216688c5fb0589d7c1e0c4eba8164758a0fdea14cf4896bcd4c40cf100181c8d8e489cb56aca93e8617989a398c358e3e385ebc38440978bda5d5a9f48ef8410dfad39c7189002a0fe37129edb7de0b6c7684a08c4ef91766cde7727ab0f560dab528f888095650d49303a419fddf5668dd5d54e0dd00b3d018b161d50d10df3ac2e6544265f13723e6dee2844415f8143a1235bd67076e5f0b3fc2907fcb0d7bf21c68d4afa645ddf41f929064b986d77bc68a9063903c230e7b219ebf7119a26344d2f32696f546f55e19ffb13ddc0fad4aee248c3eceb0e84ceb559003ac982a33014c1881c9034e427cbaa5313864292b93cba8182918feba01a97505e89f850da0ae3d3dfc820820670a3a589a55c75c3f70eff06fe013c38ae29a470859ccfc00830e69c8530699af5f7846037f8f5a01b8dada384d823d4e8201aea591087c6495c56d84c422fcd6eddbbb8baaee2ef1a42884e55e850a7c79c925d0f2a160104811f0ca2ed7af0d363c260f563e8e89c93f66ae296dd8aab90e9ed42a196f3989b7eaa3b3b8bb5edaba085d625a31eb1d303fde154682420e8e7b3632cf17a64a7d0c2e6b440b214bccecd589e581720951371fdc5e9855106411aa16c46ba49ccfb81326dbad38da930bbb6a65365aee009159d1d4e9b05e4c1349a88b37fa5d21e383d2c914f7f6f5fa795c5428ebe5dc8e4c34960edc7576faf45e2f1a44bc3b83fedd3278abfc43191c68c9b416cb8106a7d490912b6899a4aa4b1f0c784ae8a917e70ebde19aa5a6f1db8ad2ae1852dd5a512a60846a76641277d3a19296e7f2ee6f7972a78e624328597e3de5b3496eadd618bf540ad180e7f82fd16a69705ab3ed441597dca516ab798b14a43bf5bc4e358aa5a718d95d79cb3bb4adb9822938305724f500e19b387aaed497353263baec429474edaf7fb8cbc79c42800ceb4cc191c503a00f4c72a8651325d48d019a91b4abf019246f50c72f06afda1bcd1f82602b7c503ff1e05c49b68bb1142d3d4b03db8023806cd75e4a3e7069bde310cdfedf303894ac12432fcf171690426dc098271615a2a9ebc663fdc251f415804951992b90fd605e09134ff56eb32c9fe4d82a8fa5d0c97f34da16ce6a896aa9d0c409feb25b3af0552d43f86fecf6273e7c32e403ec7da58e2997308425b605422357f7d0aafd295d3ca13c9bc0b0bb3045b686fcc9bcd05d3ef7ebcc13f68ebf900a3d8bd7b4dd5d95a0528b48f88a5fba999b555beddfd344959ef56fdcab6e00e3dc3559f852ad40d198448a765f455f2ca303b981ad398e6d9a96ecad3a19fa27666f8be7ad3f48cb9fab096a4d39f7bb43ff65884416d9be210023e0a4fcf74af9cca7c9a043d4966551e78cf3d22edf07c001d4348ee86c0c41a9c6d5674fa9f1a5a9b10d1bd9078a56e1413e3ec522ae6e2bc616a4890e45e09a8d34d7752d0fe457843f3809077637c45470d08507304f0f487b88e3628cc04402ac014e0ffaccc8f6d354bb93c22716dc891c8fa00c45e61d62951fb8a1172226a9fd0972ab6d5ebf6c1cfd46be5686fea7862ef6cccdd9d1591b95cd60478a11acbf297d7b73d5346cfaaa5d7024d66ffd75028bb1743111ef6ea7e82e59a5fce3b95a773585bb1266e4fd2d75a6bf32dd5ca31237c3549f509c19ecfd9f959988122d0cd72a19245d23c76441fcbe6375d91d0834ee85d41fc35343d2fc8df31ca358263a74bbb729b32a6ee136c073b0a49ca77dd7bcff30f758f8df1aed17e8407a72e262240649df72cff6fe523478f493170620f0aec31f08ced85e6e0fbfa31f6d46b5b7f96034de857396210b92bf7c79e9dc441683d4686921c762495697c352ece73fe42c2885df749bbf621910080133480342c2e1e22814ded84860ef4caf8a098df713346ea386bfb4a569317358ee6dd1986470f5ea6c0e9dd084b8c3f3bab8fd8566715dc9f74a28e368ea7ccd57af5b964812330bc9e2233cb9b85920eb350727e85bad323881fed4d5dd9e8ffc56616b19c81d8047660525db9c73cf28afd3d1bfe6a9b5b60ffe95ae0dcbac52cdc1d0b632b7088e74ddc1c1de82f90fe6b8bbc7f8fafd08a81a984f564b159ddb128103821d04d474712314434fecd898249d322c3aa22571cc1b4c8240ec4a65770b0af61dd4998