~ / search / GHSA-m9mf-rqx6-2xpc

GHSA-m9mf-rqx6-2xpc

ThinkCMF Stored Cross-Site Scripting (XSS)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-40849

Packages

EcosystemPackageAffectedFixed in
Packagist thinkcmf/thinkcmf < 6.0.8 6.0.8

Details

As written in the advisory (Markdown source, shown as plain text).

ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's PHP session token (PHPSESSID).

References

External links from the advisory. They lead to third-party sites.