ResidenceCMS 2.10.1: When Your Property Description Gets More Attention Than Your Property
ResidenceCMS 2.10.1 might sound like a cozy place, but it’s got a stored XSS vulnerability that’s more explosive than a poorly aimed champagne cork. With just a bit of malicious HTML, even a low-privilege user can get the party started—and by party, we mean triggering XSS when unsuspecting visitors drop by.
Hot Take:
Who knew that your dream of owning a property could include a side of malicious code? ResidenceCMS is offering a special deal: buy one 2-bedroom flat, and get an XSS exploit for free! Now that’s what I call an “open house”…
Key Points:
- A stored XSS vulnerability in ResidenceCMS 2.10.1 allows low-privileged users to inject malicious content.
- The vulnerability can be triggered by anyone, including unauthorized users, once the content is edited and saved.
- The vulnerable parameter is the property description content, allowing HTML injection.
- Potentially allows attackers to execute scripts in the context of other users, including administrators.
- Identified vulnerability has been assigned the CVE identifier CVE-2024-39143.
Already a member? Log in here