CMS on 思安录 | Thinking's Security Notes https://blog.1sec.day/en-gb/tags/cms/ Recent content in CMS on 思安录 | Thinking's Security Notes Hugo -- gohugo.io en-gb Thinking Thinking Thu, 15 May 2025 00:00:00 +0000 Explore CMS v1.1 Reflected XSS: How a Community CMS's UserID Field Became the Attack Entry Point https://blog.1sec.day/en-gb/posts/2025-05-15-zero-day-explore-cms-xss/ Thu, 15 May 2025 00:00:00 +0000 Thinking https://blog.1sec.day/en-gb/posts/2025-05-15-zero-day-explore-cms-xss/ <p>The <code>user/login.php</code> and <code>admin/login.php</code> endpoints in Explore CMS v1.1 perform zero sanitization or validation on the <code>UserID</code> field — an attacker can trigger reflected XSS with the simplest <code>&lt;script&gt;alert(1)&lt;/script&gt;</code> payload, stealing sessions, cookies, and email content. This is especially dangerous for community CMS users.</p>