Executive brief
MCMS is a Java-based content management system that allows authors to publish articles to static HTML pages. An attacker with backend access can inject malicious JavaScript into the article content field, which bypasses the application's XSS filters and gets stored in the database. When the article is published, the malicious code executes in the browsers of visitors to the website, allowing the attacker to steal session cookies, credentials, or deface content.
Technical details
The vulnerability is a stored XSS in the contentDetails field of article creation. The field is explicitly excluded from the global XSS filter (XSSEscapeFilter), and the remaining regex-based blacklist (@Xss annotation via JsoupUtil.hasXSS) is incomplete, missing event handlers like onmouseover. Payloads like <svg/onmouseover=alert()> bypass validation, are stored raw in the database, and rendered without HTML escaping by FreeMarker templates during static page generation, executing in the victim's browser context.
Affected products
- MingSoft MCMS 6.1.1, 6.2.0, 6.2.1
Timeline
- 2026-09-22: disclosed