**Product Name:** InstantCMS

**Vulnerability:** Stored XSS

**Vulnerable Version:** 2.16.2 & <2.16.2

**CVE:** CVE-2024-50348

The researchers from Astra’s security team, on November 6, 2024, found a Stored Cross-Site Scripting (XSS) in InstantCMS, a free and open-source CMS that allows you to build websites. The vulnerability was identified in the photo album page’s photo upload function.

A [stored XSS vulnerability](https://owasp.org/www-community/attacks/xss/) occurs when an application allows malicious user input, is stored without proper sanitization, and is accessible to other application users.

## **CVE-2024-50348: Technical Breakdown**

### **How Was It Discovered?**

While testing on the demo app, Astra’s security researchers discovered that the uploaded images were not properly sanitized, allowing the injection of malicious scripts along with the images.

During the analysis, the `<img>` tag was used to embed the uploaded images with the XSS payload using the `onerror` attribute.

### **How To Recreate This Vulnerability?**

**Inject Payload**  
Insert the following payload in the Camera Model Name metadata field:

`test<img src="asd" onerror="alert(1)">`

**Submit Request**  
Upload the image on the photo upload page

**Observe Rendering**  
- Visit the [https://demo.instantcms.io/photos/camera-{payload}](https://demo.instantcms.io/photos/camera-%7Bpayload%7D)  
- The error occurs, and you can observe the immediate execution of the injected XSS payload.

## **Impact of Stored XSS**

### **Session Hijacking**

Once the image is injected, attackers can target users who visit the affected page and steal sensitive user session information like cookies and session tokens, leading to account takeovers.

### **Malware Propagation**

The attackers can leverage the stored XSS vulnerability to deploy malware or ransomware. Once the payload is stored, malicious scripts affect any vulnerable page user.

### **Website Defacement**

Malicious scripts can modify the content on web pages, presenting misleading information or making it hard for users to identify malicious content and engage with it.

It is one small security loophole v/s your entire website or web application.

## **Current Status**

Once the vulnerability was found, researchers notified the development team of InstantCMS, who then acknowledged the vulnerability in versions <2.16.3 of the application. This issue was mitigated by sanitizing the uploaded images and clearing the metadata in their update in v2.16.3.

## **What Can You Do?**

To avoid potential exploitation, users are strongly advised to update [InstantCMS](https://github.com/instantsoft/icms2) to the latest version, which includes essential security patches.

### **Author**  
[**Prateek Kuber**](/content/blog/author/prateek/index.html)  
Prateek is a cybersecurity professional with a strong interest in coding and a knack for crafting detailed, informative articles. Outside the world of cybersecurity, he enjoys a weekly game of football and something to binge watch!