Anchor CMS 0.12.7 – Stored Cross Site Scripting (XSS)

• Exploit Database
• 12 阅读

• 作者： /bin/neko
  日期： 2025-06-15
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/52327/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

  # Exploit Title: Anchor CMS 0.12.7 - Stored Cross Site Scripting (XSS) # Google Dork: inurl:"/admin/pages/add" "Anchor CMS" # Date: 2025-06-08 # Exploit Author: /bin/neko # Vendor Homepage: http://anchorcms.com # Software Link: https://github.com/anchorcms/anchor-cms # Version: 0.12.7 # Tested on: Ubuntu 22.04 + Apache2 + PHP 8.1 # CVE: CVE-2025-46041   # Description: Anchor CMS v0.12.7 suffers from a stored Cross-Site Scripting (XSS) vulnerability in the `markdown` field of the /admin/pages/add page. An authenticated user with page creation privileges can inject arbitrary JavaScript, which is stored and executed when the page is viewed.   # Steps to Reproduce: 1. Login to /admin 2. Navigate to Pages > Add Page 3. In the `Markdown` field, insert: <script>alert(document.domain)</script> 4. Save the page. 5. View the created page. The script executes.   # Impact: - Arbitrary JavaScript execution - Potential session hijacking or admin impersonation