Executive brief
Total.js CMS is a web content management system used to build and manage websites. The admin interface contains multiple cross-site scripting (XSS) vulnerabilities that allow attackers to inject malicious scripts through message and column formatting fields, potentially compromising admin accounts or stealing session data when administrators view affected pages.
Technical details
Two cross-site scripting (CWE-79) vulnerabilities exist in Total.js CMS 12.0.0: one in themes/admin/views/index.html affecting item.message, and another in themes/admin/public/ui.js affecting column.format. These vulnerabilities occur because user-controlled input is not properly sanitized before being reflected in HTML output. An attacker must use social engineering or account compromise to inject malicious JavaScript, but no additional authentication beyond basic admin panel access is required. Successful exploitation allows execution of arbitrary JavaScript in the context of the admin interface, potentially leading to session hijacking, credential theft, or administrative action abuse. The vulnerability was patched in version 3.3.0-13, as evidenced by commits fixing XSS output encoding in the affected components.
Affected products
- Total.js CMS <3.3.0-13
Timeline
- 2019-04-02: disclosed
- 2019-04-02: patched: Fixed in version 3.3.0-13