eyoucms v1.6.4 is vulnerable Cross Site Scripting (XSS), which can lead to stealing sensitive information of logged-in users.
cpe:2.3:a:eyoucms:eyoucms:1.6.4:*:*:*:*:*:*:*
8E52879A-3ABB-441B-B6A9-A91E6C700778
OR
Software Link : https://github.com/weng-xianhu/eyoucms
Website : http://www.eyoucms.com/
Vulnerable version 1.6.4 download address ：https://qiniu.eyoucms.com/source/EyouCMS-V1.6.4-UTF8-SP1_1015.zip
After the installation is complete, log in as admin, open the page
[![piEvffK.png](https://z1.ax1x.com/2023/10/25/piEvffK.png)](https://imgse.com/i/piEvffK)
[![piEvoOH.png](https://z1.ax1x.com/2023/10/25/piEvoOH.png)](https://imgse.com/i/piEvoOH)
Here you can fill in malicious JavaScript code to cause stored xss
[![piEvXff.png](https://z1.ax1x.com/2023/10/25/piEvXff.png)](https://imgse.com/i/piEvXff)
Enter the code and it will be automatically saved successfully
[![piEx3h6.png](https://z1.ax1x.com/2023/10/25/piEx3h6.png)](https://imgse.com/i/piEx3h6)
Refresh the page
Malicious code is inserted into the webpage
[![piEx6gS.png](https://z1.ax1x.com/2023/10/25/piEx6gS.png)](https://imgse.com/i/piEx6gS)

Causes stored XSS to steal sensitive information of logged-in users
[![piExdHA.png](https://z1.ax1x.com/2023/10/25/piExdHA.png)](https://imgse.com/i/piExdHA)
POC :

```Plaintext
"><img src=1 onerror=alert(/xss/)><
```

There is stored XSS in version 1.6.4 which can lead to stealing sensitive information of logged-in users
This is a GitHub Issue
repo:eyoucms
owner:weng-xianhu
Title : There is stored XSS in version 1.6.4 which can lead to stealing sensitive information of logged-in users
Issue date:

--- start body ---
Software Link : https://github.com/weng-xianhu/eyoucms
Website : http://www.eyoucms.com/
Vulnerable version 1.6.4 download address ：https://qiniu.eyoucms.com/source/EyouCMS-V1.6.4-UTF8-SP1_1015.zip
After the installation is complete, log in as admin, open the page
[![piEvffK.png](https://z1.ax1x.com/2023/10/25/piEvffK.png)](https://imgse.com/i/piEvffK)
[![piEvoOH.png](https://z1.ax1x.com/2023/10/25/piEvoOH.png)](https://imgse.com/i/piEvoOH)
Here you can fill in malicious JavaScript code to cause stored xss
[![piEvXff.png](https://z1.ax1x.com/2023/10/25/piEvXff.png)](https://imgse.com/i/piEvXff)
Enter the code and it will be automatically saved successfully
[![piEx3h6.png](https://z1.ax1x.com/2023/10/25/piEx3h6.png)](https://imgse.com/i/piEx3h6)
Refresh the page
Malicious code is inserted into the webpage
[![piEx6gS.png](https://z1.ax1x.com/2023/10/25/piEx6gS.png)](https://imgse.com/i/piEx6gS)

Causes stored XSS to steal sensitive information of logged-in users
[![piExdHA.png](https://z1.ax1x.com/2023/10/25/piExdHA.png)](https://imgse.com/i/piExdHA)
POC :

```Plaintext
"><img src=1 onerror=alert(/xss/)><
```

--- end body ---

comments :
--- start comments ---

--- end comments ---